Assess with agent-based policies

You can conduct secure configuration policy assessments against assets in your environments with the Insight Agent. Whether you’re implementing security best practices or adhering to a specific security compliance framework, the Insight Agent is able to collect asset information without the need for credential management or a corporate network connection. The information collected by the Insight Agent is then sent to InsightVM, once every 24 hours, for assessment.

Requirements

Why use agent-based policies?

Agent-based assessments, when run regularly against an organization’s assets, can quickly identify security misconfigurations and help to reduce the attack surface of your organization.

• Credentials are not needed for agent-based assessments.
• An on-premise connection is not required for agent-based assessments, which is especially beneficial for assessing remote assets.

How does it work?

Policy compliance is based on how well assets comply with the rules of each agent-based assessment.

Select from a large library of pre-built configuration baselines and recommendations to monitor the assets in your environment for any compliance deviation. The asset information collected by the agent is assessed against recommendations within each benchmark. In InsightVM, these recommendations are called rules.

After enabling an agent-based policy for your assets, InsightVM schedules the agents in your environment to collect configuration information and then assesses your assets once every 24 hours against the selected agent-based policy. The assessment results can then be viewed and adjusted in InsightVM.

Enable an agent-based policy

When you assess a policy, you are actively checking which assets in your environment align with or deviate from the rules outlined in specific configuration standards. You must select and enable each agent-based policy you want your environment to be assessed against.

1. In the navigation menu, click Policies > Agent-Based Policy.
2. On the Agent-Based Policy page, on the Available Policies tab, select an agent-based policy you want to assess against.
3. On the Policy Details page, click Enable to start regularly assessing your environment against the selected agent-based policy.
4. When prompted, specify the assets you want to assess against the enabled agent-based policy by selecting either:
   • All assets. This applies the policy to all applicable assets that have the Insight Agent installed.
   • Custom scope. This allows you to select and assess specific assets that have the Insight Agent installed. You must use a query to select these assets.
5. Click Enable.

Manage which assets are being assessed against a specific agent-based policy at any time by clicking Manage Assessment Scope on the Policy Details Page.

Disable an agent-based policy

1. In the navigation menu, click Policies > Agent-Based Policy.
2. On the Agent-Based Policy page, on the Enabled Policies tab, select the agent-based policy that you want to disable.
3. On the Policy Details page, click Disable > Yes, disable it to stop assessing your assets against the selected agent-based policy.
   • When an agent-based policy is disabled, the data from the last assessment is only retained for 30 days.

Create a custom policy

Custom policies allow you to address specific security concerns unique to your organization. To create a custom policy, you can either upload a policy or edit a copy of an existing policy. Refer to Uploading custom SCAP policies for more information on uploading policies. Refer to Custom Policy Builder for more information on editing existing policies.

To upload a custom policy:

1. On the Agent-Based Policy page, click Manage Custom Policies.

2. Click Upload Policy.

3. In the pop-up, select a file to upload. You must upload a ZIP file with a unique name and where the file suffixes are the following:

   • -cpe-dictionary.xml
   • -cpe-oval.xml
   • -oval.xml
   • -xccdf.xml

   It is recommended that you choose a file with a unique name devised from a naming convention to help you identify which policies have been customized for your organization.

4. Click Upload.

   • If you receive an error message, you must resolve the issue mentioned and repeat these steps for the policy to upload successfully.
   • A spinning image may display during the upload. This is normal and may be due to the number of rules included as the time to complete an upload depends on the policy’s complexity and size.

To customize an existing policy:

1. On the Agent-Based Policy page, click Manage Custom Policies.
2. Select a policy that you want to edit.
3. Click the Copy Policy button to launch the Custom Policy Builder.
4. Edit the aspects of the policy you want to customize.
5. Click Save.

After uploading or editing a custom policy, it may take several minutes to finish processing depending on the size of the policy. You can check the state of your custom policy's Status and Agent Compatible in the Manage Custom Policies listing table.

Enable a custom policy

Enable custom policies for agent-based assessment by selecting any policy under the Custom Publisher. After a custom policy is enabled for agent-based assessment, only a Global Administrator can edit the custom policy.

1. In the navigation menu, click Policies > Agent-Based Policy.
2. On the Agent-Based Policy page, on the Available Policies tab, select a Custom policy that you want to enable for agent-based assessment.
3. Review the selected custom policy configuration.
4. On the Policy Details page, click Enable.

If the custom policy meets the requirements for agent-based assessment and is validated successfully, your environment will be regularly assessed against the selected custom policy.

Delete a custom policy

You can delete a custom policy if new versions are available or if you no longer want to assess against a custom policy.

To delete a custom policy:

1. In the navigation menu, click Policies > Agent-Based Policy.
2. On the Agent-Based Policy page, click Manage Custom Policies.
3. Use the Publisher filter to find Custom (Agent-Based) policies.
4. Select the custom policy that you want to delete.
5. Click Delete. This action is permanent. Deleted policies cannot be recovered.
   • If you are deleting a custom policy that was enabled for agent-based assessment, your assessment stops and your data is not retained.
   • If you are deleting an engine-based custom policy, deleting from the Manage Custom Policies page does not affect the custom policy on the console. To delete the custom policy permanently, you must delete from the Scan Engine Policy page.

Adjust assessment results

An override can be used to manually change the assessment result of a rule to either passed, failed, or N/A.

Create an override

1. Click Create Override on the Rule Details table.
2. In the pop-up, select to create an override for All assets or based on either an IP Range/Netmask/Host Name. To create an override for a singular asset, see Review rule details.
3. Complete the required fields.
4. Click Submit and approve.

Delete an override

You may want to delete an override if the overridden status no longer applies, or if you want to create a similar override, but with different parameters.

To delete an override:

1. From the Rule Details page, click on the overridden rule you want to delete.
2. Click Delete on the Override details page.

View agent-based assessments

You can view your compliance results in the Available Policies listing table, the Enabled Policy listing table, Policy Details pages, and the various agent-based policy dashboard cards.

You can export agent-based assessment results to CSV from the Policy listing table, Policy Details page, and Rule Details page, and convert them to PDF through the dashboard cards.

View available policies

The Available Policies listing table displays all of the agent-based policies that you can assess within your environment. You can view a specific agent-based policy’s details by clicking on its name:

View custom policies

When your custom policy meets the necessary requirements for agent-based assessment, you can view your newly created or edited custom policy in the Manage Custom Policies listing table or in the Available Policies listing table.

The Manage Custom Policies listing table displays all of the policies within your environment and includes custom policy specific UI elements:

View enabled policies

The Enabled Policies listing table displays the agent-based policies that you've enabled for assessment. You can view a specific agent-based policy’s details by clicking on its name in the table.

Enabled Policies Compliance tracks the percentage of rules, across all enabled policies, that have a 100% asset compliance score. A rule only scores 100% if all the assets that have been assessed by that rule have a status of pass.

Display agent-based policies in the dashboard

There are 5 agent-based policy compliance dashboard cards available to organize and display your data. You can view more detailed information for each card by clicking Expand Card.