Chapter 8. Managing compliance policies
A compliance policy is a scheduled audit that checks the specified hosts for compliance against a specific XCCDF profile from a SCAP content.
You specify the schedule for scans on Satellite Server and the scans are performed on hosts. When a scan completes, a report in ARF format is generated and uploaded to Satellite Server. The compliance policy makes no changes to the scanned host.
A compliance policy defines a SCAP client configuration and a cron schedule. The policy is then deployed together with the SCAP client on hosts to which the policy is assigned.
8.1. Creating a compliance policy
By creating a compliance policy, you can define and plan your security compliance requirements, and ensure that your hosts remain compliant to your security policies.
Prerequisites
- You have configured Satellite for your selected compliance policy deployment method.
You have available SCAP contents, and eventually tailoring files, in Satellite.
- To verify what SCAP contents are available, see Chapter 6, Listing available SCAP contents.
- To upload SCAP contents and tailoring files, see Chapter 7, Configuring SCAP contents.
-
Your user account has a role assigned that has the
view_policiesandcreate_policiespermissions.
Procedure
- In the Satellite web UI, navigate to Hosts > Compliance > Policies.
- Click New Policy or New Compliance Policy.
- Select the deployment method: Ansible, Puppet, or Manual. Then click Next.
- Enter a name for this policy, a description (optional), then click Next.
Select the SCAP Content and XCCDF Profile to be applied, then click Next.
Note that Satellite does not detect whether the selected XCCDF profile contains any rules. An empty XCCDF profile, such as the
Default XCCDF Profile, will return empty reports.- Optional: To customize the XCCDF profile, select a Tailoring File and a XCCDF Profile in Tailoring File, then click Next.
Specify the scheduled time when the policy is to be applied. Select Weekly, Monthly, or Custom from the Period list. The Custom option allows for greater flexibility in the policy’s schedule.
- If you select Weekly, also select the desired day of the week from the Weekday list.
- If you select Monthly, also specify the desired day of the month in the Day of month field.
- If you select Custom, enter a valid Cron expression in the Cron line field.
- Select the locations to which to apply the policy, then click Next.
- Select the organizations to which to apply the policy, then click Next.
- Optional: Select the host groups to which to assign the policy.
- Click Submit.
8.2. Viewing a compliance policy
You can preview the rules which will be applied by specific OpenSCAP content and profile combination. This is useful when you plan policies.
Prerequisites
-
Your user account has a role assigned that has the
view_policiespermission.
Procedure
- In the Satellite web UI, navigate to Hosts > Compliance > Policies.
- In the Actions column of the required policy, click Show Guide or select it from the list.
8.3. Editing a compliance policy
In the Satellite web UI, you can edit compliance policies.
Puppet agent applies an edited policy to the host on the next run. By default, this occurs every 30 minutes. If you use Ansible, you must run the Ansible role manually again or have configured a recurring remote execution job that runs the Ansible role on hosts.
Prerequisites
-
Your user account has a role assigned that has the
view_policiesandedit_policiespermissions.
Procedure
- In the Satellite web UI, navigate to Hosts > Compliance > Policies.
- Click the name of the required policy.
- Edit the necessary attributes.
- Click Submit.
8.4. Deleting a compliance policy
In the Satellite web UI, you can delete existing compliance policies.
Prerequisites
-
Your user account has a role assigned that has the
view_policiesanddestroy_policiespermissions.
Procedure
- In the Satellite web UI, navigate to Hosts > Compliance > Policies.
- In the Actions column of the required policy, select Delete from the list.
- Click OK in the confirmation message.
