Tell me about the SCAP Individual Host Report

Launch the Individual Host Report to see the SCAP compliance posture for a particular host in a selected SCAP policy.

When is this report available?When is this report available?

This report is available only when the SCAP application is enabled for your subscription and you have compliance management privileges.

I'm ready to launch my report. What are the steps?

Go to PC > Reports and select Reports > New > SCAP Report > Interactive. Select Individual Host and click Run. Tell us which policy and host you want to report on, and choose other report settings. Click Run again.

Tell me about the Display optionTell me about the Display option

When you're running your report use the Display option to filter the hosts displayed in the report based on posture. You have these options: Passed (Fixed), Failed (includes Error and Unknown) or Ignored (includes Not Applicable, Not Checked, Not Selected and Informational).

Tell me about what's in my report

Tell me about the summaryTell me about the summary

The summary section shows the SCAP policy title, benchmark, profile, version and technology, the specified report source options, and the host selected for the report.

Tell me about results and postureTell me about results and posture

Each rule in the report is listed with the posture for the selected host. Our service evaluates the test results for all the nodes (definitions and test sections) according to the rule and determines whether the host satisfied the conditions of the rule.

Passed - The test results for all the nodes satisfied the conditions of the rule.

Failed - In a case where the evidence has a node with the result Error or Unknown, our service will assign the posture Failed since the host did not satisfy the conditions of the rule. If the result is Error, our service reports Failed (Error). If the result is Unknown, our service reports Failed (Unknown).

A rule is ignored if you see one of these postures: Not Applicable, Not Checked, Not Selected or Informational. Not Checked indicates that the rule refers to checks in checking systems other than OVAL (http://oval.mitre.org/XMLSchema/oval-definitions-5). This includes OCIL checks.

How to view CCE information and mappingsHow to view CCE information and mappings

In the Results section of your report, we'll show you current CCE IDs for each rule, as defined in the SCAP policy. Click on any CCE ID to get additional information, including mappings to NIST SP 800-53 control identifiers. These appear under References. Please note that CCE IDs will be displayed only if they are specified in the SCAP data stream.

What are CCE4 IDs?What are CCE4 IDs?

These are old CCE v4 IDs for the rule, as defined in the SCAP policy.

Tell me about evidenceTell me about evidence

Evidence is available in the report when the Evidence option is selected in the report source. You can tell whether there is evidence in the report by placing your mouse over a row in the Results section. When evidence is available, the browser pointer changes from an arrow to a hand and the row (rule) is highlighted. Click the row to see the evidence for the rule on the host. By reviewing the evidence you can easily determine why the rule passed or failed for the host. The evidence content for a rule is displayed in a tree structure with nodes that represent the logic of the rule and the scan tests performed on the host. You can expand and collapse sections of the evidence tree by hovering your mouse over a node and then clicking the link to change the view. You will notice when you move your cursor over a node, the browser pointer will change to a hand and the link will be underlined so you can follow the link. Each node in the evidence tree identifies the OVAL test result status so you can determine compliance within the rule sections. A Red node in the evidence tree indicates a failed test. A Definition node identifies an OVAL definition test and results for the rule.

Want to download the OVAL definitions?Want to download the OVAL definitions?

If you ran your report on a policy with custom OVAL definitions, you can go to File > Download to download the OVAL definitions in XML format.

How do I find the Patches Report?How do I find the Patches Report?

The rule titled "Security Patches Up-To-Date" provides evidence for special patches tested during the most recent SCAP scan of each host in the SCAP policy. These include all patches defined in the "patches" file in the SCAP policy when present. For each host you'll see the patch status. The status Pass indicates the patch was found during the last SCAP scan on the host, and the status Fail (in Red) indicates the patch was not found during the last SCAP scan on the host.