Assess with agent-based policies

Agent-based policy is a secure configuration assessment feature in InsightVM that allows organizations to assess assets in their environments with the Insight Agent. Whether you’re implementing security best practices or adhering to a specific security compliance framework, the Insight Agent is able to collect asset information without the need for credential management or a corporate network connection. The information collected by the Insight Agent is then sent to InsightVM, once every 24 hours, for assessment.

Requirements

Why use agent-based policies?

Agent-based policies, when run regularly against an organization’s assets, can quickly identify security misconfigurations and help to reduce the attack surface of your organization.

• Credentials are not needed for agent-based policies.
• An on-premise connection is not required for agent-based policies, which is especially beneficial for assessing remote assets.

How does it work?

Policy compliance is based on how well assets comply with the rules of each agent-based policy.

Select from a large library of pre-built configuration baselines and recommendations to monitor the assets in your environment for any compliance deviation. The asset information collected by the agent is assessed against recommendations within each benchmark. In InsightVM, these recommendations are called rules.

After enabling an agent-based policy for your assets, InsightVM schedules the agents in your environment to collect configuration information and then assesses your assets once every 24 hours against the selected agent-based policy. The assessment results can then be viewed and adjusted in InsightVM.

Enable an agent-based policy

When you assess a policy, you are actively checking which assets in your environment align with or deviate from the rules outlined in specific configuration standards. You must select and enable each agent-based policy you want your environment to be assessed against.

1. In the navigation menu, click Policies > Agent-based Policy.
2. On the Agent Based Policies page, on the All Policies tab, select an agent-based policy you want to assess against.
3. On the Policy Details page, click Enable to start regularly assessing your environment against the selected agent-based policy.
4. When prompted, specify the assets you want to assess against the enabled agent-based policy by selecting either:
   • All assets. This applies the policy to all applicable assets that have the Insight Agent installed.
   • Custom scope. This allows you to select and assess specific assets that have the Insight Agent installed. You must use a query to select these assets.
5. Click Enable.

Manage which assets are being assessed against a specific agent-based policy at any time by clicking Manage Assessment Scope on the Policy Details Page.

Disable an agent-based policy

1. In the navigation menu, click Policies > Agent-based Policy.
2. On the Agent Based Policies page, on the Enabled Policies tab, select the agent-based policy that you want to disable.
3. On the Policy Details page, click Disable > Yes, disable it to stop assessing your assets against the selected agent-based policy.
   • When an agent-based policy is disabled, the data from the last assessment is only retained for 30 days.

Adjust assessment results

An override can be used to manually change the assessment result of a rule to either passed, failed, or N/A. Global Administrators can approve and delete overrides.

Create an override

1. Click Create Override on the Rule Details table.
2. In the pop-up, select to create an override for All assets or based on either an IP Range/Netmask/Host Name. To create an override for a singular asset, see Review rule details.
3. Complete the required fields.
4. Click Submit and approve.

Delete an override

You may want to delete an override if the overridden status no longer applies, or if you want to create a similar override, but with different parameters.

To delete an override:

1. From the Rule Details page, click on the overridden rule you want to delete.
2. Click Delete on the Override details page.

View agent-based policies

You can view your compliance results in the All Policies Listing table, the Enabled Policy Listing table, Policy Details pages, and the various agent-based policy dashboard cards.

You can export agent-based policy results to CSV from the Policy Listing table, Policy Details page, and Rule Details page, and convert them to PDF through the dashboard cards.

View all policies

The All Policies Listing table displays all of the agent-based policies that you can assess within your environment. You can view a specific agent-based policy’s details by clicking on its name:

View enabled policies

The Enabled Policies Listing table displays the active agent-based policies that are being assessed within your environment. You can view a specific agent-based policy’s details by clicking on its name in the table.

Enabled Policies Compliance tracks the percentage of rules, across all enabled policies, that have a 100% asset compliance score. A rule only scores 100% if all the assets that have been assessed by that rule have a status of pass.

Display agent-based policies in the dashboard

There are 5 agent-based policy compliance dashboard cards available to organize and display your data. You can view more detailed information for each card by clicking Expand Card.