Chapter 3. Managing SCAP security policies in the Insights for RHEL compliance service

Procedure

1. Navigate to the Security > Compliance > SCAP policies page.
2. Locate the policy you want to edit.
3. Click on the policy name. This opens the policy details view.

4. Wherever you see a pencil icon, you can click on the icon to edit the details in that field. Editable fields include

   • Compliance threshold
   • Business objective
   • Policy description
5. After you edit a field, click the blue checkmark to the right of the field to save your input.

Procedure

1. Navigate to the Security > Compliance > SCAP policies page.
2. Locate the policy you want to edit.
3. On the right side of the policy row, click the More actions icon, , and click Edit policy.
4. In the Edit popup, click the Rules tab.

5. Click on a RHEL minor version.

   Important

   Because a different SCAP Security Guide (SSG) version exists for each minor version of RHEL, you must edit the rules for each minor version of RHEL separately.

6. Use the Name filter and search function to locate the rules to remove.

   Note

   With the Name primary filter selected, you can search by the rule name or its identifier.

7. Uncheck the box next to any rule you want to remove.

   Or, check the box next to any rule you want to add.

8. Repeat these steps for each RHEL minor version tab.
9. Click Save.

Verification

1. Navigate to the Security > Compliance > SCAP policies page and locate the edited policy.
2. Click on the policy and verify that the included rules are consistent with the edits you made.

1. Navigate to the Security > Compliance > SCAP policies page.
2. Locate the policy you want to edit.
3. On the right side of the policy row, click the More actions icon, , and click Edit policy.

4. In the Edit popup, click the Systems tab.

   A list of all available systems is displayed.

   Systems that are already included in the policy have a checkmark in the box to the left side of the system name.

   Systems without a checkmark next to the system name are not included in this policy.

5. Search for a system by name. To include that system in the policy, check the box next to the system name.

   Or, to remove the system from the policy, uncheck the box next to the system name.

6. Click Save to save your changes.

Verification

1. Navigate to the Security > Compliance > SCAP policies page and locate the edited policy.
2. Click on the policy and verify that the included systems are consistent with the edits you made.

Procedure

1. Open the API catalog in a web browser. The API catalog lists available APIs for Insights and other services.
2. Select Compliance from the catalog and click v2. The Cloud Services for RHEL Compliance API v2 page opens. The page lists the base URL of the Compliance API and any requirements for authentication.
3. Under the Policies list, click the drop-down arrow next to Update a Policy. The description for the operation includes parameters that you can use to refine your API call, as well as expected responses from the server. In addition, the panel on the right side of the page generates an example API call for the PATCH operation in multiple programming languages.
4. In the panel, click the drop-down and select the language you prefer (for example, Python) from the list of options. The panel displays sample code for the PATCH operation, formatted in python syntax.

5. Copy the sample code and paste it into a Python code file where you want to invoke the PATCH command. For example:

   import requests
   url = "https://console.redhat.com/policies/%7Bpolicy_id%7D"
   headers = {"Content-Type": "application/vnd.api+json"}
   response = requests.patch(url, headers=headers)
   print(response.json())

   Copy to Clipboard Toggle word wrap
6. Paste the policy_id for the policy that you want to update in place of %7Bpolicy_id%7D.

7. Paste the update that you want to make to the policy in place of application/vnd.api+json. The update takes the form object: value. For example, paste compliance_threshold: 50 to change the compliance threshold to 50.

   Note

   To see the fields that you can update for the policy, click the policy_update link under the Request Body Schema heading next to the sample code. The link shows the available fields: business_objective, compliance_threshold, and description and their expected values.

8. Press Enter to run your code.

   If the server returns a response of 202, your API call was successful. If the code returns a response other than 202, refer to the error message included with the response code to determine how the API call failed and how to remedy the reason for the failure.