Terminology

The following list defines key terms and concepts used in HPE Server Automation Audit and Remediation:

• Archived Audit Result/Snapshot: Archiving audit results and snapshots allows you to move them from the audit result or snapshot list and keep them available for historical purposes.
• Audit: A set of rules (which may contain individual checks) that expresses the desired state of a managed server’s configuration objects, such as a server’s file system directory structure or files, a server’s Windows Registry, application configuration, and so on. An audit also contains sources (servers, snapshots, or snapshot specifications), targets (servers or snapshots), rule exceptions, and a schedule.
• An audit’s rules can be linked to an audit policy—which means the rules of the audit policy are substituted for those in the audit. An audit can be run to baseline compare server configuration object values against a golden server, a server snapshot, or user-defined values, to determine how values differ. When an audit reports a difference between servers or user-entered values, you can install software and server objects to remediate the differences so that servers conform to your audit rules.
• Audit Job: The process that occurs when you run an audit. An audit job can be run immediately one time or on a recurring basis by scheduling the job. When an audit job is finished, it produces an audit result that reports the differences.
• Audit Rule Type: An audit can contain the following types of rules:
• Comparison: A rule that compares a server’s or snapshot’s configurations of a server with other managed servers or snapshots.
• Value-based (user-defined): A rule that compares one or more set of user-defined values. This type of audit includes an audit that links to an audit policy.
• Non-existence: Checks for the non-existence of an object, to determine if it does not exist on the target server.  If the object exists on the target server, then the rule is out of compliance.  Note that, at runtime, the source server, if any, is not queried.  Also, if a Wildcard rule object is selected, it will only apply to the target server.
• Audit Policy: A collection of rules that defines a desired configuration for a server. A policy can be used by an audit in the following ways:
  • Link: A linked policy maintains a persistent connection between the audit and the policy. This means that the rules in the audit are exactly those of the audit policy and if any updates are made to the policy, the latest changes are also reflected in the audit to which the policy is linked. When an audit policy is linked to an audit or snapshot specification, the rules are shown inside the audit or snapshot specification as read-only. The rules inside the audit policy remain editable.
  • Import (replace, non-linked): When you import a policy into an audit, the connection between the audit and the audit policy is no longer maintained. You can make changes to the audit without affecting the policy. Conversely, any changes or updates made to the policy will not be reflected in the audit.
  • Import (merge): When an audit policy is imported and merged into an audit, the audit policy's rules are added to the rules already present in the audit. No persistent link between the audit and the audit policy is maintained. During the merge, if rules are found to conflict, the newly imported rules from the audit policy will replace the rules in the audit policy.
• Audit Result: The results of running an audit. This information shows how configuration-object values of a target server, or multiple servers, match/do not match the values defined in the audit.
• Exception: A server and specific rules that has been excepted or disabled, so that when the audit is run, the rule exception is not checked on the selected server. This server is excluded when determining audit compliance.
• Compliance: The degree to which a server’s configuration conforms to a check or test established in a collection of rules defined in an audit, a snapshot specification, or an audit policy. Compliance in Audit and Remediation is defined by the audit’s or snapshot’s rules that specify the values expected of the target servers. If the values on the target server are different than specified in the audit’s rules, the server is considered Non-Compliant.
• Policy Setter: A user who is responsible for defining server configuration compliance standards (the way a server should be configured) and audit policies in your organization.
• Rule: A check on a particular server configuration object that includes a desired value and an optional remediation value.
• There are two types of rules:
  • server-based rule: derived directly from a source server
  • user-defined rule: created by a user
• If you are subscribed to BSA Essentials Subscription Services, you can access predefined rules that define a wide range of industry compliance standards, such as the latest patch supplement for Microsoft Windows, current regulatory compliance policies (FISMA, Sarbanes-Oxley), user-created rules from the EP developer community, daily vulnerability content updates, and so on.
• Server Object: An object from a server to which an audit or snapshot specification rule can be applied. This can be a value, such as minimum password length, or an object, such as a file or directory, registry entry, Windows Services hardware configuration, and so on.
• Snapshot: A representation of the configuration state of a managed server, where the information was captured on a certain date, at a certain time of day. A snapshot is the result of a snapshot specification job that has been run.
• Snapshot Specification: A template that defines exactly what you want to capture for a server’s configuration. You configure the snapshot specification's rules and then run it. When you run an audit from a snapshot specification, the audit uses all the information defined in the specification, then applies any filters that you have defined. The results are a snapshot.
• Snapshot Specification Job: The process that occurs when you run a snapshot specification. A snapshot job can be run once or on a recurring basis, by scheduling the job. When a snapshot specification job is completed, it produces a snapshot.
• Target: The server or servers that you run an audit against or take a snapshot of. The target for an audit can be a server, multiple servers, a group of servers, or a snapshot. The target for a snapshot can also be other servers.