4 Understand Compliance Results

Oracle Configuration and Compliance uses a compliance score to give a numerical measurement to your system based on how compliant it is. This service makes use of alerts, remediations, and reports to give users a course of action.

Topics:

• Create an Alert Rule

• Prioritize Violations

• Plan Remediations

• Upload SCAP Results

• Generate Assessment Report

Create an Alert Rule

Using Oracle Configuration and Compliance, you can create rules and select users who get notifications when the desired conditions activate.

1. From the menu, select Library, click Rules, and click Add.

2. Enter a name for the rule.

3. Select whether this rule applies to entity types or to individual entities, and click Add Condition.

4. Select Condition Type, and click Rule or Rule Set.

5. Select the Scope of this alert rule.

6. Select a Metric with the desired Operator, Warning, and Critical values.

7. Click Save.

8. Enter the names of the users to be notified when this alert rule activates, and click Save.

   Note:

   You can also notify your channels by adding them to this alert rule.

Prioritize Violations

Assessment results help compliance administrators prioritize compliance violations, create a remediation plan based on business objectives, and validate that those changes have been successfully made.

You can sort the assessment results by:

• Entity Type

• Entity Instance

• Individual Violation

By evaluating the compliance violation details, you can understand compliance violations and plan the optimal remediation. The Compliance Service Assessment Results Detail page provides a scoped compliance posture snapshot.  You can view the on-demand or reoccurring Assessment Template execution results scoped to a set of entities.

1. From the menu, select Assessments, then click Runs.
2. Click on a Assessment Run ID.
3. Select a severity such as Critical or High.
4. Click on the Violation Name to display the Violations Details page and plan your remediation.

Plan Remediations

Planning remediations will give you a clear vision on how to take care of compliance violations.

You can write and execute an automated remediation script or manually remediate the violation. Rerun your assessment template, validate successful remediation of the violation, and then verify the remaining violations.

You can find the following list located in the Compliance Violation Details Panel.

1. From the Summary page, click the Violations tab.

2. Click the Violation Name.

• Rule Description - A description of the rule.

• Entity - The host, database, or middleware target that the rule was run against.

• Rule-Set Name - representing the typed benchmark that the rule belonged to and produce the violation.

• Rationale - Explains the importance of this rule and consequences of non-compliance.

• Remedy - Explains the steps necessary to bring the entity into compliance with regard to this rule.

Upload SCAP Results

Upload SCAP results from OpenSCAP and other SCAP engines directly to Oracle Configuration and Compliance .

1. From the Oracle Configuration and Compliance landing page, click the Upload button.
2. Enter a Upload Name.
3. Select the Entities.
4. Upload the Result File.
5. Click Upload.

Results should be for a valid and licensed entity for an existing rule-set. Results will be available shortly after upload.

Generate Assessment Report

Generate a complete, self-contained HTML report for any historic assessment using Oracle Configuration and Compliance.

1. From the Oracle Configuration and Compliance landing page, select Results, then click History.
2. Select an Entity.
3. Select a Rule-Set.
4. Click a Data Point from the Stack Bar graph.
5. Click Report.

The Assessment Report HTML file will be generated.