Scan results

Scan report metrics bar

On the Scan report metrics bar, the Compliance scan status section displays the compliance score with any applicable exceptions. The metrics bar also displays the percentage of nodes that passed, failed, or could not be evaluated, and the scan initiation date and time. The Puppet Enterprise job status section displays the status of scan jobs in Puppet Enterprise.

Compliance Dashboard

The Compliance Dashboard provides a breakdown of your latest CIS scan.

The dashboard can be filtered by environment, operating system, and node group in order to show subsets of your infrastructure. It has several widgets containing information about your nodes and exceptions:

Node compliance

From the Node results page, click a node name to navigate to the Node detail page and see the results of the latest scan on that node:

• The Scan status pane shows a status breakdown for the latest scan, including the total number of rules and the number of rules that passed, failed, reported an error, or had an unknown status. You can hover over the statuses in the legend to see percentages in the donut chart. The chart and legend reflect only the statuses that are subject to scoring. Non-scoring statuses (for example, cases in which a recommendation is not applicable or cannot be automatically assessed) are excluded. Statuses are described in the following table:

  Value	Included in scoring?	Description
  Pass	Yes	The target system or component state satisfied all the conditions of any checks or rules for the recommendation.
  Fail	Yes	The target system or component state did not satisfy at least one condition of any checks or rules for the recommendation.
  Error	Yes	The assessor checking engine encountered a system error and could not complete the test. The status of the target's compliance is not certain.
  Unknown	Yes	The assessor was unable to collect, interpret, or evaluate against any check or rule conditions associated with the recommendation.
  Other	No	The Other status includes all statuses that do not fall into the categories of Pass, Fail, Error, or Unknown. For details about the statuses that are included in the Other category, see the following rows.
  Manual	No	This recommendation cannot be fully automated and requires manual evaluation. This status occurs when, in the CIS Benchmarks, a recommendation is deemed important but cannot be fully and reliably verified without a manual check by an organization. This status corresponds to the Extensible Configuration Checklist Description Format (XCCDF) term, Informational.
  Not Applicable	No	Rules, checks, or both were not applicable to the target. This situation typically occurs when the benchmark and platform are mismatched.
  Not Checked	No	The recommendation was not evaluated as there are no rule or check properties.
  Not Selected	No	This recommendation was not part of the profile selected for the configuration assessment.
  Informational	No	This is the same result that is displayed as Manual on the HTML report. The recommendation cannot be fully automated and requires manual evaluation.

• The Rule scan results table lists each rule that was checked and the status of that rule from the latest scan. The table also shows the date and time of the last successful scan for each rule.

Rule results

From the Node results page, in the Node results table, click a node. Then, in the Rule scan results table, click a rule. The Rule detail page includes the following information:

• The Scan status pane shows the total number of nodes scanned and detailed results. You can hover over the results to see percentages in the donut chart. The compliance score in the chart and legend reflects only the statuses that are subject to scoring. Non-scoring statuses (for example, cases in which a recommendation is not applicable or cannot be automatically assessed) are excluded.

• A tabbed section displays information about each rule:

  • Fix — the steps you can take to fix the rule if it is failing on a node.
  • Description — information on what is being checked.
  • Rationale — the reason why it is important to check that rule.
• The Node results table lists each node the rule has been checked against and shows the current status, including when the node was last checked and when it last passed that rule. The table shows the profile, the environment in which the scan took place (for example, production or test), and any exceptions that apply.
• The Exceptions tab displays any exceptions that are relevant to the selected rule.

Exporting results

To export your results as a .csv file, select Export CSV at the top right of the Node results tab, and then choose whether to export raw data or a report summary. After exporting, you can download past reports from the Generated reports tab in the left menu.

The raw data export contains detailed scan results for each rule, including the rule's name, ID, and status, whether the rule has an exception against it, and details about the exception if applicable.

Rather than raw data, the summary export provides an exception score and an adjusted compliance score for each rule. The exception score is the latest overall compliance score for all nodes. This score accounts for any temporary compliance rule exceptions in place, and any rules with exceptions are excluded from the overall compliance score. The adjusted compliance score does not account for any temporary compliance rule exceptions, instead providing a true compliance score for all nodes.

Scan rule report

You can view a report about scan results for a single rule. The Scan report: Rule performance page lists the nodes on which the rule was run and the results.

From the Scans page, click a scan report. Ensure that the Rules tab is displayed. Locate a rule in the table and click View report.

Scan node report

You can view a report about scan results for a single node. The Scan report: Node performance page lists the rules that were run on the node and the results.

From the Scans page, click a scan report. Ensure that the Nodes tab is displayed. In the table, locate a node and click View report.

Scan data retention policy

By default, no retention period is defined for scan data in Security Compliance Management. You can, however, enable this feature on the Config tab in the complyadm::configuration plan. We recommend that you run no more than 1 complete scan per week and retain data for no more than 14 weeks at a time. If you do plan to retain historical data for more than 14 complete scans, increase Security Compliance Management PostgreSQL capacity in the complyadm::configuration plan by approximately 3GB per additional scan.