Desired compliance

Puppet Comply — latest

Sections

Set your desired compliance. This is the benchmark and profile that you to assign to a particular node. It is what is scanned on that node by default. Most of the time, you only need to set this once for your nodes.

There are two ways to specify desired compliance:

Option 1: Allow Comply to automatically set desired compliance. Based on fact information from PE, Comply can automatically assign an appropriate benchmark for each operating system, along with a Level 1 profile, to nodes that have not been set. This is the quickest way to get up and running with desired compliance.
Option 2: Manually set desired compliance. If you want to choose a specific benchmark and profile for your nodes, or even a custom profile, option two provides this flexibility.

Note: Only one benchmark and profile can be assigned to each node.

Option 1: Allow Comply to automatically set desired compliance

In Comply, click Nodes.

Comply lists the nodes that have been classified with the comply class. If you do not see any nodes, ensure you have classified your nodes correctly.
In the message box that appears in the top right corner, click Apply suggested profiles.
Comply automatically assigns the appropriate benchmark, along with a Level 1 profile, to all the nodes that have not already been set, on your current page. To apply the suggested profile to all the nodes in your inventory, you must do this on every page.

Tip: If you want to customize your scans to fit your organization's internally defined standards, see Creating custom profiles, which shows you how to exclude rules in a profile.

Results

The ✔️ sign in the Profile assigned column tells you that the desired compliance is set. You can view the node's information, including its assigned benchmark and profile, by clicking on the node. If you want to change a node's desired compliance, use the drop-down menu and click Update.

What to do next

Now that you have applied desired compliance, you can use this option to run a CIS scans.

Option 2: Manually set desired compliance

In Comply, click Nodes.
Comply lists the nodes that have been classified with the comply class. If you do not see any nodes, ensure you have classified your nodes correctly.
Click on the node for which you want to specify desired compliance.
In the window that appears on the right, you can see facts about the node and whether desired compliance has been set.
Choose the CIS benchmark and profile that you want to assign to the node.

The benchmark and profile you set here is the desired compliance option for future scans.

If you have created a custom profile, you can set it as the desired compliance by clicking Use an associated custom profile?.
Click Update.

Results

What to do next

Now that you have applied desired compliance, you can use this option to run scans.