Skip to content

[RHACS] [Docs] ROX-27682: Adding updates to Compliance reporting documentation #94394

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: rhacs-docs-main
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion _topic_maps/_topic_map.yml
Original file line number Diff line number Diff line change
Expand Up @@ -208,7 +208,7 @@ Topics:
File: compliance-feature-overview
- Name: Monitoring workload and cluster compliance
File: monitoring-workload-and-cluster-compliance
- Name: Scheduling compliance scans and assessing profile compliance (Technology preview)
- Name: Scheduling compliance scans and assessing profile compliance
File: scheduling-compliance-scans-and-assessing-profile-compliance
- Name: Evaluating security risks
File: evaluate-security-risks
Expand Down
37 changes: 11 additions & 26 deletions modules/all-report-jobs-tab.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -10,33 +10,18 @@ The *All report jobs* tab shows the current status and requester for each report

The report jobs are organized into the following groups:

* *Completed*: Indicates which report jobs have been finished.
* *Status*: Displays the current state of each report job.
Completed:: Indicates which report jobs have been finished.
Status:: Displays the current state of each report job.
+
The following values are associated with the report job status:
+
** `Waiting`
+
The report job is in the queue.

** `Preparing`
+
The report job is being processed.

** `Ready for download`
+
The report is ready and available for download.

** `Successfully sent`
+
The report has been successfully emailed.

** `Error`
+
There was an issue with the report job.

** `None`
+
No recent jobs are available.
`Waiting`::: The report job is in the queue.
`Preparing`::: The report job is being processed.
`Report ready for download`::: The report is ready and available for download.
`Partial report ready for download`::: A report is partially complete and ready for download.
`Report successfully sent`::: The report was successfully emailed.
`Partial report successfully sent`::: A report is partially complete and was successfully emailed.
`Report failed to generate`::: There was an issue with the report job. Hover to view the error message.
`None`::: There are no recent jobs available.

* *Requester*: Identifies the user or system account that initiated the report job.
Requester:: Identifies the user or system account that initiated the report job.
16 changes: 13 additions & 3 deletions modules/analyzing-compliance-scan-schedules.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -16,16 +16,26 @@ For more information about how to create a compliance scan schedule, see "Custom

.Procedure

. In the {product-title-short} portal, click *Compliance -> Schedules*.
. In the {product-title-short} portal, click *Compliance -> OpenShift Schedules*.
. Optional: To sort the compliance scan schedules in ascending or descending order, select the *Name* column heading.
. Select the compliance scan you created.
. Select the compliance scan that you have created.
. Optional: To sort the cluster health information in ascending or descending order, select a column heading in the *Clusters* section.
. Optional: To view the status of the one or more requested jobs from different users:
.. Click the *All report jobs* tab.
.. You can find the status of the one or more report jobs in the *Status* column.
.. Optional: Choose the appropriate method to re-organize the information in the *All report jobs* section:
*** To sort the jobs in ascending or descending order, select the *Completed* column heading.
*** To filter based on the report run states, select one or more states from the *Filter by report run states* drop-down list.
*** To filter the jobs based on the report run states, select one or more states from the *Filter by report run states* drop-down list.
+
The following values are associated with the report run states:
+
**** `Waiting`
**** `Preparing`
**** `Report ready for download`
**** `Partial report ready for download`
**** `Report successfully sent`
**** `Partial report successfully sent`
**** `Report failed to generate`
*** To view only the jobs that you created, set *View only my jobs* to on.
.. Optional: To view the job details associated with a report job, perform the following steps:
... Locate the report job for which you want to view the job details.
Expand Down
4 changes: 2 additions & 2 deletions modules/assessing-the-profile-compliance-across-clusters.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -6,11 +6,11 @@
[id="assessing-the-profile-compliance-across-clusters_{context}"]
= Assessing the profile compliance across clusters

By viewing the coverage page, you can assess the profile compliance for nodes and platform resources across clusters.
By viewing the *Coverage* page, you can assess the profile compliance for nodes and platform resources across clusters.

.Prerequisites

* You have installed the Compliance Operator.
* You have installed the Compliance Operator version 1.6.0 or later.
+
For more information about how to install the Compliance Operator, see "Using the Compliance Operator with {product-title}".
+
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -23,8 +23,8 @@ The compliance container collects the following data about your environment:
[NOTE]
====
* The following terms are associated with a compliance scan:
** *Control* describes a single line item in an industry or regulatory standard that an auditor uses to evaluate an information system for compliance with that standard. {product-title-short} verifies evidence of compliance with a single control by performing one or more checks.
** *Check* is the single test performed during a single control assessment.
Control:: Describes a single line item in an industry or regulatory standard that an auditor uses to evaluate an information system for compliance with that standard. {product-title-short} verifies evidence of compliance with a single control by performing one or more checks.
Check:: Is the single test performed during a single control assessment.
* Some controls have multiple checks associated with them. If one of the associated checks for a control fails, the entire control state is marked as Fail.
====

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,9 @@ You can run out-of-the-box compliance scans based on the following industry stan
* *National Institute of Standards and Technology (NIST) Special Publication 800-190*
* *NIST Special Publication 800-53*
* *Payment Card Industry Data Security Standard* (PCI DSS)
* *OpenShift Compliance Operator Profiles*: The Compliance Operator evaluates the compliance of both the {ocp} Kubernetes API resources and the nodes running the cluster. There are several profiles available as part of the Compliance Operator installation.
* *OpenShift Compliance Operator Profiles*
+
The Compliance Operator evaluates the compliance of both the {ocp} Kubernetes API resources and the nodes running the cluster. There are several profiles available as part of the Compliance Operator installation.
+
For more information about the available profiles, see link:https://docs.redhat.com/en/documentation/openshift_container_platform/{ocp-latest-version}/html-single/security_and_compliance/index#compliance-operator-supported-profiles[Supported compliance profiles].

Expand Down
20 changes: 10 additions & 10 deletions modules/configuration-details-tab.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -13,19 +13,19 @@ The *Configuration details* tab displays information about the scan schedule inf

The *Parameters* section organizes information into the following groups:

* *Name*: The unique identifier for the compliance scan.
* *Description*: Specifies additional information about the compliance scan.
* *Schedule*: Specifies when the compliance scans should run.
* *Last scanned*: The timestamp of the last compliance scan performed.
* *Last updated*: The last date and time that the compliance scan data was modified.
Name:: The unique identifier for the compliance scan.
Description:: Specifies additional information about the compliance scan.
Schedule:: Specifies when the compliance scans should run.
Last scanned:: The timestamp of the last compliance scan performed.
Last updated:: The last date and time that the compliance scan data was modified.

[discrete]
== Clusters section

The *Clusters* section organizes information into the following groups:

* *Cluster*: Lists the one or more clusters associated with a compliance scan.
* *Operator status*: Indicates the current health or operational status of the Operator.
Cluster:: Lists the one or more clusters associated with a compliance scan.
Operator status:: Indicates the current health or operational status of the Operator.

[discrete]
== Profiles section
Expand All @@ -37,6 +37,6 @@ The *Profiles* section lists the one or more profiles associated with a complian

The *Delivery destinations* section organizes information into the following groups:

* *Email notifier*: Specifies the email notification system or tool set up to distribute reports or alerts.
* *Distribution list*: Lists the recipients who should receive the notifications or reports.
* *Email template*: Specifies the email format used for the notifications. You can use the default or customize the email subject and body as needed.
Email notifier:: Specifies the email notification system or tool set up to distribute reports or alerts.
Distribution list:: Lists the recipients who should receive the notifications or reports.
Email template:: Specifies the email format used for the notifications. You can use the default or customize the email subject and body as needed.
37 changes: 21 additions & 16 deletions modules/coverage-page-overview.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -4,32 +4,37 @@

:_mod-docs-content-type: CONCEPT
[id="coverage-page-overview_{context}"]
= Coverage page overview
= OpenShift Coverage page overview

When you view the coverage page and apply a filter to a schedule, all results are filtered accordingly. This filter remains active for all coverage pages until you delete it. You can always view the results based on a single profile.
When you view the *Coverage* page and apply a filter to a schedule, all results are filtered accordingly. This filter remains active for all coverage pages until you delete it. You can always view the results based on a single profile.

You can select profiles grouped according to their associated benchmarks by using the toggle group. You calculate the compliance percentage based on the number of passed checks in relation to the total number of checks.

[NOTE]
====
The *Coverage* page now only shows the results of the last scan. If the last scan fails, the {rh-rhacs-first} deletes the previous results and you cannot see any information for this scan on the *Coverage* page.
====

The *Checks* view lists the profile checks and enables you to easily navigate and understand your compliance status.

The profile check information is organized into the following groups:

* *Check*: The name of the profile check.
* *Controls*: Shows the various controls associated with each check.
* *Fail status*: Shows the checks that have failed and require your attention.
* *Pass status*: Shows the checks that have been successfully passed.
* *Manual status*: Shows the checks that require a manual review because additional organizational or technical knowledge is required that you cannot automate.
* *Other status*: Shows the checks with a status other than pass or fail, such as warnings or informational statuses.
* *Compliance*: Shows the overall compliance status and helps you to ensure that your environment meets the required standards.
Check:: The name of the profile check.
Controls:: Shows the various controls associated with each check.
Fail status:: Shows the checks that have failed and require your attention.
Pass status:: Shows the checks that have been successfully passed.
Manual status:: Shows the checks that require a manual review because additional organizational or technical knowledge is required that you cannot automate.
Other status:: Shows the checks with a status other than pass or fail, such as warnings or informational statuses.
Compliance:: Shows the overall compliance status and helps you to ensure that your environment meets the required standards.

The *Clusters* view lists the clusters and enables you to effectively monitor and manage your clusters.

The cluster information is organized into the following groups:

* *Cluster*: The name of the cluster.
* *Last scanned*: Indicates when the individual clusters were last scanned.
* *Fail status*: Shows the clusters whose scan has failed and which require your attention.
* *Pass status*: Shows the clusters that have successfully passed all checks.
* *Manual status*: Shows the checks that require a manual review because additional organizational or technical knowledge is required that you cannot automate.
* *Other status*: Shows the clusters that have a status other than pass or fail, such as warnings or informational alerts.
* *Compliance*: Shows the overall compliance status of your clusters and helps you to ensure that they meet the required standards.
Cluster:: The name of the cluster.
Last scanned:: Indicates when the individual clusters were last scanned.
Fail status:: Shows the clusters whose scan has failed and which require your attention.
Pass status:: Shows the clusters that have successfully passed all checks.
Manual status:: Shows the checks that require a manual review because additional organizational or technical knowledge is required that you cannot automate.
Other status:: Shows the clusters that have a status other than pass or fail, such as warnings or informational alerts.
Compliance:: Shows the overall compliance status of your clusters and helps you to ensure that they meet the required standards.
18 changes: 9 additions & 9 deletions modules/customizing-and-automating-your-compliance-scans.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ You can only have one schedule that scans the same profile on the same cluster.

.Prerequisites

* You have installed the Compliance Operator.
* You have installed the Compliance Operator version 1.6.0 or later.
+
For more information about how to install the Compliance Operator, see "Using the Compliance Operator with {product-title}".
+
Expand All @@ -29,7 +29,7 @@ For more information about how to install the Compliance Operator, see "Using th

.Procedure

. In the {product-title-short} portal, click *Compliance -> Schedules*.
. In the {product-title-short} portal, click *Compliance -> OpenShift Schedules*.
. Click *Create scan schedule*.
. In the *Create scan schedule* page, provide the following information:

Expand All @@ -39,7 +39,7 @@ For more information about how to install the Compliance Operator, see "Using th

** *Schedule*: Adjust the scan schedule to fit your required schedule:

*** *Frequency*: From the drop-down list, select how often you want to perform the scan.
*** *Frequency*: From the drop-down list, select how often you want to run the scan. If you do not select a frequency, `Daily` is selected automatically.
+
The following values are associated with how often you want to perform the scan:

Expand Down Expand Up @@ -69,9 +69,9 @@ These values are only applicable if you specify the frequency of scan as `Weekly
*** *Time*: Start to type the time in `hh:mm` at which you want to run the scan. From the list that is displayed, select a time.

. Click *Next*.
. In the *Clusters* page, select one or more clusters that you want to include in the scan.
. Select one or more healthy clusters that you want to include in the scan.
. Click *Next*.
. In the *Profiles* page, select one or more profiles that you want to include in the scan.
. Select one or more profiles that you want to include in the scan.
. Click *Next*.
. Optional: To configure email delivery destinations for manually triggered reports, perform the following steps:
+
Expand Down Expand Up @@ -136,8 +136,8 @@ Optional: To customize the email subject and body as needed, perform the followi

.Verification

. In the {product-title-short} portal, click *Compliance -> Schedules*.
. Select the compliance scan you have created.
. In the {product-title-short} portal, click *Compliance -> OpenShift Schedules*.
. Select the compliance scan that you have created.
. In the *Clusters* section, verify that the operator status is healthy.
. Optional: To edit the scan schedule, perform the following steps:
.. From the *Actions* drop-down list, which is in the upper right of the page, select *Edit scan schedule*.
Expand All @@ -148,7 +148,7 @@ Optional: To customize the email subject and body as needed, perform the followi
[NOTE]
====
* You can only send a scan report manually if you have configured an email delivery destination.
* Compliance reporting is only available for clusters running Compliance Operator version 1.6 or later.
* Compliance reporting is only available for clusters running Compliance Operator version 1.6.0 or later.
====
** From the *Actions* drop-down list, which is in the upper right of the page, select *Send report*.
+
Expand All @@ -157,7 +157,7 @@ You receive a confirmation that you have requested to send a report.
+
[NOTE]
====
Compliance reporting is only available for clusters running Compliance Operator version 1.6 or later.
Compliance reporting is only available for clusters running Compliance Operator version 1.6.0 or later.
====
.. From the *Actions* drop-down list, which is in the upper right of the page, select *Generate download*.
+
Expand Down
23 changes: 21 additions & 2 deletions modules/monitoring-and-analyzing-the-health-of-your-clusters.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -15,9 +15,28 @@ Wait until the Compliance Operator returns the scan results. It might take a few

.Procedure

. In the {product-title-short} portal, click *Compliance -> Coverage*.
. In the {product-title-short} portal, click *Compliance -> OpenShift Coverage*.
. Select a cluster to view the details of the individual scans.
. Optional: Enter the name of the profile check in the *Filter by keyword box* to view the status.
. Optional: Choose the appropriate method to re-organize the information in the *Coverage* page.
** To filter the scan results based on a scan schedule, from the drop-down list, select the scan schedule. If you do not select a particular scan schedule, *All scan schedules* is selected automatically.
** To filter the scan results based on an entity and its attributes, do any of the following tasks:
+
[IMPORTANT]
====
To select multiple entities and attributes, click the right arrow icon to add another search criteria.
====
+
*** To filter the scan results based on a profile check, enter the name of the profile check in the search bar to view the status.
*** To filter the scan results based on cluster attributes, from the drop-down list, select *Cluster*, and then select an attribute. Enter the details of the cluster attribute in the search bar to view the status.
+
The following values are associated with the attributes of a cluster:
+
**** `ID`
**** `Name`
**** `Label`
**** `Type`
**** `Platform Type`

. Optional: From the *Compliance status* drop-down list, select one or more statuses by using which you want to filter the scan details.
+
The following values are associated with how you want to filter the scan details:
Expand Down
Loading