# Compliance Scanning

> Run automated CIS Benchmark and SCAP compliance scans on Linux servers in SecureBaseline Cloud - schedule assessments, review findings, and export results

Source: https://opennix.org/en/docs/haas/compliance-scanning/

## Overview

Compliance scanning evaluates your servers against CIS (Center for Internet Security) benchmarks. The platform performs automated security compliance checks using industry-standard SCAP protocols.

## Navigation

**Menu**: Infrastructure > Compliance

## Understanding CIS Benchmarks

CIS Benchmarks are configuration guidelines for securing operating systems. Each benchmark contains hundreds of rules organized into sections:

1. **Initial Setup** - Filesystem, software updates
2. **Services** - Disable unnecessary services
3. **Network Configuration** - Firewall, kernel parameters
4. **Logging and Auditing** - Audit rules, log management
5. **Access Control** - SSH, PAM, sudo configuration
6. **System Maintenance** - File permissions, user accounts

### Compliance Levels

- **Level 1** - Basic security, minimal impact on functionality
- **Level 2** - Enhanced security, may affect some functionality

## Page Layout

### Statistics Cards

The top of the page displays four summary cards:

| Card | Description |
|------|-------------|
| Total Scans | Number of scans for selected host |
| Latest Score | Compliance percentage from most recent completed scan |
| Passed Rules | Number of passed rules in latest scan |
| Failed Rules | Number of failed rules in latest scan (red color) |

### Compliance Trends Chart

Below the statistics, a line chart shows compliance score trends over time (last 30 days). The chart title includes the profile name.

### Toolbar

| Control | Description |
|---------|-------------|
| Host Selector | Dropdown to select which host's scans to view |
| Status Filter | Filter scans by status (All, Completed, Running, Pending, Failed) |
| Search | Search by Scan ID |
| New Scan | Create a new compliance scan |
| Refresh | Reload scan list |
| Export CSV | Export scan list to CSV file |
| Export JSON | Export scan list to JSON file |

### Scan List Table

| Column | Description |
|--------|-------------|
| Scan ID | First 8 characters of scan UUID |
| Status | Scan status with color indicator |
| Score | Compliance percentage (color-coded: green >=80%, yellow >=60%, red <60%) |
| Passed | Number of passed rules |
| Failed | Number of failed rules |
| Duration | Scan duration in seconds |
| Created | Scan creation timestamp |
| Actions | View Results and Download Report buttons (for completed scans) |

## Running a Scan

### Single Host Scan

1. Select a host from the **Host Selector** dropdown
2. Click **New Scan** button
3. In the modal:
   - **Host**: Pre-filled with selected host, can change
   - **SCAP Profile**: Select profile matching host OS (profiles filtered by detected OS)
4. Click **Create Scan**

### Bulk Scan

1. Go to **Hosts** page
2. Select multiple hosts using checkboxes
3. Click **Bulk Scan (N)** button
4. Select a SCAP profile from the dropdown
5. Click **Start Scans**

Progress bar shows scan creation progress.

## SCAP Profiles

Available profiles depend on the detected OS of the host:

| OS | Available Profiles |
|----|-------------------|
| Ubuntu 20.04 | CIS Level 1 Server, CIS Level 2 Server |
| Ubuntu 22.04 | CIS Level 1 Server, CIS Level 2 Server |
| Ubuntu 24.04 | CIS Level 1 Server, CIS Level 2 Server |
| Debian 11 | CIS Level 1 Server, CIS Level 2 Server |
| Debian 12 | CIS Level 1 Server, CIS Level 2 Server |
| RHEL 8/9 | CIS Level 1 Server, CIS Level 2 Server |
| AlmaLinux 8/9 | CIS Level 1 Server, CIS Level 2 Server |
| Rocky Linux 8/9 | CIS Level 1 Server, CIS Level 2 Server |
| Oracle Linux 8/9 | CIS Level 1 Server, CIS Level 2 Server |
| Amazon Linux 2 | CIS Level 1 Server, CIS Level 2 Server |

## Scan Status

| Status | Color | Description |
|--------|-------|-------------|
| Pending | Gray | Scan is queued |
| Running | Blue (processing) | Scan is in progress |
| Completed | Green | Scan finished successfully |
| Failed | Red | Scan encountered an error |

## Host Task Exclusivity

Only one operation can run on a host at a time. If a host already has an active scan, hardening job, or remediation running, new requests return a 409 Conflict error: "Host has active tasks. Wait for them to complete."

This applies to all operations: compliance scans, vulnerability scans, hardening jobs, and remediation. Scheduled tasks also respect this constraint and skip hosts with active work.

## Auto-Refresh

When there are running or pending scans, the page automatically refreshes every 10 seconds to show updated status.

## Viewing Results

### Results Modal

Click the **Results** button on a completed scan to open the results modal:

#### Toolbar
- **Filter by Result**: Dropdown to filter by pass/fail/error/notapplicable
- **Total Rules**: Shows total number of rules checked
- **Failed Rules Count**: Red tag showing failed rules count
- **Export CSV**: Export results to CSV
- **Export JSON**: Export results to JSON

#### Results Table

| Column | Description |
|--------|-------------|
| Rule ID | Unique identifier for the CIS rule |
| Rule Title | Description of the rule |
| Severity | High (red), Medium (orange), Low (blue) |
| Result | Pass (green), Fail (red), Error (yellow), Not Applicable (gray), Not Checked (blue) |
| AI Help | Explain button (if LLM is configured) |

#### Expandable Row Details

Click the expand icon to view:
- **Description**: Detailed explanation of the rule
- **Rationale**: Why this rule is important for security
- **Remediation**: Commands or steps to fix the issue
- **Explain with AI** button (if LLM is configured)

### Quick Fix Feature

The Quick Fix feature allows you to remediate failed rules:

1. In the Results modal, select failed rules using checkboxes (only failed rules can be selected)
2. Click **Quick Fix (N)** button (shows count of selected rules)
3. Confirm the action in the popup
4. A hardening job is created to fix the selected rules

### AI Explanation

If LLM is configured (see AI Settings), you can get AI-powered explanations:

1. Click the **Explain** button in the AI Help column, or
2. Expand a rule and click **Explain with AI** button
3. A modal opens showing:
   - Rule ID, Severity, and Result tags
   - Rule title
   - AI-generated explanation in markdown format

## Understanding Results

### Pass

The system configuration meets the CIS requirement.

### Fail

The system configuration does not meet the CIS requirement. Review the rule and consider applying hardening.

### Error

The check could not be completed. Common causes:
- Missing required package
- Permission issues
- Unsupported configuration

### Not Applicable

The rule does not apply to this system. For example:
- IPv6 rules when IPv6 is disabled
- GUI rules on server without desktop

### Not Checked

The rule was not evaluated (skipped).

## Reports

### Viewing Reports

1. Find the completed scan
2. Click **Report** button
3. Report opens in new browser tab (HTML format)

### Report Contents

- Executive summary
- Compliance score
- Detailed findings
- Rule descriptions
- Remediation guidance

### Exporting Data

#### Scan List Export
1. Click **Export CSV** or **Export JSON** in toolbar
2. Downloads all visible scans

#### Results Export
1. Open Results modal
2. Click **CSV** or **JSON** button
3. Downloads all rule results for that scan

## Compliance Trends

The Compliance page shows a trends chart:

- Line graph of compliance scores over last 30 days
- Profile name displayed in chart title
- Helps track improvement over time

The Dashboard also shows compliance trends across all hosts.

## Best Practices

### Regular Scanning

- Schedule weekly compliance scans (see Schedules page)
- Compare results over time using trends chart
- Track improvement after hardening

### Profile Selection

- Start with Level 1 for basic security
- Use Level 2 for high-security environments
- Match profile to server role

### Result Analysis

- Focus on high-severity failures first
- Use Quick Fix to remediate selected rules
- Use AI explanation to understand complex rules
- Group similar failures for batch remediation
- Document exceptions for business-justified deviations

## Troubleshooting

### Scan Stuck in Pending

1. Check worker service is running
2. Verify Redis connection
3. Check worker logs for errors
4. Check Jobs page for detailed status

### Scan Failed

1. Check SSH connectivity to host (use Check action on Hosts page)
2. Verify sudo permissions for SSH user
3. Check available disk space
4. Review error message in Jobs page

### Low Compliance Score

1. Review failed rules in Results modal
2. Filter by severity (High first)
3. Use Quick Fix to auto-remediate
4. Re-scan after hardening to measure improvement

### No Profiles Available

1. Ensure host OS is detected (check Hosts page)
2. Use **Detect OS** action on the host
3. Verify the OS version is supported

## Related Pages

- [Hosts](/en/docs/haas/hosts/) - Manage servers and run bulk scans
- [Jobs](/en/docs/haas/jobs/) - View scan job progress and errors
- [Hardening](/en/docs/haas/hardening/) - Apply security fixes
- [Schedules](/en/docs/haas/schedules/) - Schedule recurring scans
- [AI Assistant](/en/docs/haas/ai-assistant/) - Configure AI for rule explanations