Beginner’s guide to Comply

Welcome to the Beginner’s guide to Comply! As a new user, you'll need to perform some initial installation and configuration tasks, and then we'll show you how to use the core features of Comply.

You're just a few steps away from enforcing compliant configurations across your infrastructure. Before you begin, we recommend familiarizing yourself with our terminology and Comply overview.

Step 1: Install and configure Comply

Use the main documentation to install and configure Comply. If you already completed these steps, proceed to step 2.

  • Install Puppet Application Manager (PAM)
  • Set up Comply

Step 2: Set desired compliance

Desired compliance is the benchmark and profile that you to assign to a particular node. It is what is scanned on that node by default. Most of the time, you only need to set this once for your nodes.

Based on fact information from PE, Comply automatically assigns an appropriate benchmark for each operating system, along with a Level 1 profile, to nodes that have not been set. Accepting this option is the quickest way to get up and running with desired compliance.

Alternatively, you can manually choose your own benchmark and profiles. For more information, see Manually set desired compliance.

Step 3: Run a CIS scan

You are now ready to run a scan.

This topic describes how to run an initial ad hoc scan.
  1. In Comply, click Scans, and then Run an ad hoc scan.
  2. In the Benchmark drop-down, select Desired compliance or a benchmark and profile of your choice.
    If you have not set desired compliance, see Setting desired compliance for instructions.
  3. Next, select an option from the Profile drop-down. If you want to use a custom profile for this scan, select the Use an associated custom profile? option and choose the relevant option from the Custom profile drop-down.
    If you have not set desired compliance, see Setting desired compliance for instructions.
  4. Click Next to review the PE credentials and environment you want the scan to run on.
  5. Click Next to see the nodes selected for scanning.
    To only scan a subset of nodes, deselect any that you do not want to include.
    Debug mode: By default, assessor logs are set to WARN level. If you need to troubleshoot an issue, you can set the logging level to DEBUG for the scan by clicking Run in debug mode. The assessor logs can then be retrieved from the individual node.

    On Linux and macOS platforms the assessor log is located at:

    /opt/puppetlabs/comply/Assessor-CLI/logs/assessor-cli.log

    On Windows the assessor log is located at:

    C:/ProgramData/PuppetLabs/comply/Assessor-CLI/logs/assessor-cli.log

    Note that scanning in debug mode increases the size of the assessor log file significantly.

  6. Click Scan.
    You are taken to the Activity Feed, which lists each scan. Scans are run as a task in PE. To see the details of the job, click the job ID to be taken to PE.
    Tip: You can also run a scan by clicking the Scan nodes button at the top right corner on several pages. This option uses the nodes listed on the page you are currently viewing.
  7. In Comply, navigate to the Dashboard page to see the results of your scan.
    See Viewing scan results for a description of the scan data.
Results
Congratulations! You've completed the Beginner’s guide to Comply. You're now familiar with the core features and know how to run CIS scans with Comply. To find out how you can enforce and automate CIS benchmarks on your failing nodes, see Enforce CIS benchmarks.