Compliance Scanning

Overview

Compliance scanning evaluates your servers against CIS (Center for Internet Security) benchmarks. The platform uses OpenSCAP to perform automated security compliance checks.

Navigation

Menu: Infrastructure > Compliance

Understanding CIS Benchmarks

CIS Benchmarks are configuration guidelines for securing operating systems. Each benchmark contains hundreds of rules organized into sections:

1. Initial Setup - Filesystem, software updates
2. Services - Disable unnecessary services
3. Network Configuration - Firewall, kernel parameters
4. Logging and Auditing - Audit rules, log management
5. Access Control - SSH, PAM, sudo configuration
6. System Maintenance - File permissions, user accounts

Compliance Levels

• Level 1 - Basic security, minimal impact on functionality
• Level 2 - Enhanced security, may affect some functionality

Page Layout

Statistics Cards

The top of the page displays four summary cards:

Compliance Trends Chart

Below the statistics, a line chart shows compliance score trends over time (last 30 days). The chart title includes the profile name.

Toolbar

Scan List Table

Running a Scan

Single Host Scan

1. Select a host from the Host Selector dropdown
2. Click New Scan button
3. In the modal:
   • Host: Pre-filled with selected host, can change
   • SCAP Profile: Select profile matching host OS (profiles filtered by detected OS)
4. Click Create Scan

Bulk Scan

1. Go to Hosts page
2. Select multiple hosts using checkboxes
3. Click Bulk Scan (N) button
4. Select a SCAP profile from the dropdown
5. Click Start Scans

Progress bar shows scan creation progress.

SCAP Profiles

Available profiles depend on the detected OS of the host:

Scan Status

Auto-Refresh

When there are running or pending scans, the page automatically refreshes every 10 seconds to show updated status.

Viewing Results

Results Modal

Click the Results button on a completed scan to open the results modal:

Toolbar

• Filter by Result: Dropdown to filter by pass/fail/error/notapplicable
• Total Rules: Shows total number of rules checked
• Failed Rules Count: Red tag showing failed rules count
• Export CSV: Export results to CSV
• Export JSON: Export results to JSON

Results Table

Expandable Row Details

Click the expand icon to view:

• Description: Detailed explanation of the rule
• Rationale: Why this rule is important for security
• Remediation: Commands or steps to fix the issue
• Explain with AI button (if LLM is configured)

Quick Fix Feature

The Quick Fix feature allows you to remediate failed rules:

1. In the Results modal, select failed rules using checkboxes (only failed rules can be selected)
2. Click Quick Fix (N) button (shows count of selected rules)
3. Confirm the action in the popup
4. A hardening job is created to fix the selected rules

AI Explanation

If LLM is configured (see AI Settings), you can get AI-powered explanations:

1. Click the Explain button in the AI Help column, or
2. Expand a rule and click Explain with AI button
3. A modal opens showing:
   • Rule ID, Severity, and Result tags
   • Rule title
   • AI-generated explanation in markdown format

Understanding Results

Pass

The system configuration meets the CIS requirement.

Fail

The system configuration does not meet the CIS requirement. Review the rule and consider applying hardening.

Error

The check could not be completed. Common causes:

• Missing required package
• Permission issues
• Unsupported configuration

Not Applicable

The rule does not apply to this system. For example:

• IPv6 rules when IPv6 is disabled
• GUI rules on server without desktop

Not Checked

The rule was not evaluated (skipped).

Reports

Viewing Reports

1. Find the completed scan
2. Click Report button
3. Report opens in new browser tab (HTML format)

Report Contents

• Executive summary
• Compliance score
• Detailed findings
• Rule descriptions
• Remediation guidance

Exporting Data

Scan List Export

1. Click Export CSV or Export JSON in toolbar
2. Downloads all visible scans

Results Export

1. Open Results modal
2. Click CSV or JSON button
3. Downloads all rule results for that scan

Compliance Trends

The Compliance page shows a trends chart:

• Line graph of compliance scores over last 30 days
• Profile name displayed in chart title
• Helps track improvement over time

The Dashboard also shows compliance trends across all hosts.

Best Practices

Regular Scanning

• Schedule weekly compliance scans (see Schedules page)
• Compare results over time using trends chart
• Track improvement after hardening

Profile Selection

• Start with Level 1 for basic security
• Use Level 2 for high-security environments
• Match profile to server role

Result Analysis

• Focus on high-severity failures first
• Use Quick Fix to remediate selected rules
• Use AI explanation to understand complex rules
• Group similar failures for batch remediation
• Document exceptions for business-justified deviations

Troubleshooting

Scan Stuck in Pending

1. Check worker service is running
2. Verify Redis connection
3. Check worker logs for errors
4. Check Jobs page for detailed status

Scan Failed

1. Check SSH connectivity to host (use Check action on Hosts page)
2. Verify sudo permissions for SSH user
3. Check available disk space
4. Review error message in Jobs page

Low Compliance Score

1. Review failed rules in Results modal
2. Filter by severity (High first)
3. Use Quick Fix to auto-remediate
4. Re-scan after hardening to measure improvement

No Profiles Available

1. Ensure host OS is detected (check Hosts page)
2. Use Detect OS action on the host
3. Verify the OS version is supported

Related Pages

• Hosts - Manage servers and run bulk scans
• Jobs - View scan job progress and errors
• Hardening - Apply security fixes
• Schedules - Schedule recurring scans
• AI Assistant - Configure AI for rule explanations