Configuration roadmap for continuous compliance for servers

Tip

Click here to create a PDF of this topic.

This topic provides a high-level description of the configuration tasks required to implement the BMC Continuous Compliance for Servers solution, part of Compliance Automation. Prior to configuring the solution, ensure that you have completed the installation tasks described in Installation-roadmap-for-continuous-compliance-for-servers.

The following sections describe the configuration tasks that are required to implement the Continuous Compliance for Servers workflows, and provides pointers to publications with detailed instructions:

Step 1: Configure a grid

After the TrueSight Orchestration platform components are installed and running, configure a grid. The grid distributes information across the TrueSight Orchestration components. See Managing grids in the TrueSight Orchestration online documentation.

Step 2: Verify logon account IDs

Verify that you have a BMC Remedy ITSM administrative logon ID. During the BMC Continuous Compliance for Server Automation solution installation, this account is used to export the ITSM templates.

Step 3: Configure BMC Remedy ITSM

In BMC Remedy ITSM, do the following:

 Task

 Description

Configure group auto assignments for change tickets

Failed to execute the [excerpt-include] macro. Cause: [Error number 2 in 0: No wiki with id [confluencePage:page] could be found]. Click on this message for details.

Configure group auto assignments for incidents

Failed to execute the [excerpt-include] macro. Cause: [Error number 2 in 0: No wiki with id [confluencePage:page] could be found]. Click on this message for details.

Review and verify the BMC Remedy artifacts

Prior to configuring BMC Remedy ITSM, you must use the Content Installer to install the BMC Remedy artifacts.

When you run the installer, you select values for the key fields to customize the pre-configured BMC Remedy artifacts required by the solution. For descriptions of the artifacts, see BMC-Remedy-artifacts. For installations requiring a custom solution, or to complete the ITSM configuration, use the BMC Remedy ITSM Application Administration Console to create and configure a new company, create a template, or modify existing templates.

Warning: When changing template settings, BMC recommends backing up the default templates modifying the template values. Do not change the default user group TrueSight Server Automation role. Changing the user group role causes the system to fail to perform as expected.

To customize BMC Remedy ITSM templates, complete the following steps:

  1. From the BMC Remedy IT Service Management Application Administration Console, select Custom Configuration > Change Management System > Template > Template.
  2. Double-click Template, then select the template to modify.
  3. Click View, and then change the template values as required.
  4. When you have finished modifying the template, click Save.

For details about the BMC Remedy artifacts, see Artifact-and-configuration-reference-for-Continuous-Compliance-for-Server-Automation.

Back to top

Step 4: Configure and enable the required adapters

In TrueSight Orchestration, use Grid Manager to complete the configuration of the following required adapters:

  • BMC Remedy AR System actor adapter
  • BMC Remedy AR System monitor adapter
  • TrueSight Orchestration BladeLogic Operations Manager (TrueSight Server Automation) adapter
  • BMC Atrium CMDB adapter
  • SNMP monitor adapter
  • File adapter
  • Web Services adapter 

For details on configuring these adapters for the solution, see Configuring-adapters-for-the-Continuous-Compliance-for-Server-Automation-solution.

Step 5: Configure the connection between TrueSight Server Automation and TrueSight Orchestration

Through the TrueSight Server Automation Console, you must add the configuration information required to connect to TrueSight Orchestration.

Task

Description

Select job types to which to apply job approval and other Change Automation options

Some content is unavailable due to permissions.

Assign job approval permissions

Some content is unavailable due to permissions.

Set up the connection to TrueSight Orchestration

Using the TrueSight Server Automation Console, you must add the configuration information required to connect to TrueSight Orchestration.

The integration between BMC Continuous Compliance for Server Automation and TrueSight Orchestration supports connections to a single grid only. The connection with TrueSight Orchestration is established through the CDP or through a high availability CDP (HACDP). Other types of peers are not supported.

  1. From the TrueSight Server Automation Console, ensure that your role is granted the AOConfig.* and the AutomationPrincipal.* authorizations.
  2. Select Configuration > AO Configuration.
  3.  On the AO Configuration dialog box, click Add.
  4.  On the Add new AO configuration dialog box, enter the configuration information required to connect to TrueSight Orchestration, and then click OK.
    • Host - IP address or fully-qualified host name of the TrueSight Orchestration CDP server.
    • Port - Port number used to connect to the TrueSight Orchestration CDP.
    • Grid Name - Name defined for the TrueSight Orchestration grid. Specify the name of a grid only if this is the first defined CDP connection.
      For additional CDP connections, this field is read-only, as all defined connections must be on the same grid.
    • User Name - Name of the TrueSight Orchestration user used to log on to the CDP. This user must be associated with the ADMIN role in TrueSight Orchestration.
    • Password - TrueSight Orchestration password for the specified user.
    • Time-out - Amount of time, in seconds, before a BMC Continuous Compliance for Server Automation job that connects to TrueSight Orchestration times out.
      The default is 300 seconds (5 minutes).
    • Primary AO - Specifies this CDP as the primary instance. In a high-availability environment with multiple CDP instances, ensure that you select the correct CDP, as defined in TrueSight Orchestration.
    • SSL enabled? - Specifies if the connection to the CDP is SSL-enabled and based on an HTTPS connection (as described in Enabling HTTPS support for the TrueSight Orchestration connection).
  5. To test if you can connect to the CDP using the host, port, grid name, user name, and password details that you specified, click Check Connection.
  6. To add additional CDP connections to TrueSight Orchestration to ensure high availability, repeat step 2 and step 3 for each additional CDP instance of the same grid.
    If you define multiple TrueSight Orchestration CDP instances, ensure that only one of your CDPs is set as the primary instance (using the Primary AO check box). Multiple CDPs installed on a grid form a High Availability (HACDP) environment and allow communication to continue even if a connection with one CDP fails.
  7. In the AO Configuration dialog box, click OK to save your changes and close the dialog box.

Enable HTTPS support on TrueSight Orchestration

To secure the communication of data between BMC Continuous Compliance for Server Automation and TrueSight Orchestration, you must enable an HTTPS connection on both products.

Some content is unavailable due to permissions.


Enable HTTPS support for TrueSight Orchestration on TrueSight Server Automation

Some content is unavailable due to permissions.

Back to top

Step 6: Activate and configure the required modules using Grid Manager

Before you can use the BMC Continuous Compliance for Server Automation solution, ensure that the modules are properly integrated to work with the BMC Remedy ITSM system by activating the modules on the grid.

To activate modules on the grid:

  1. Using Grid Manager, select Manage > Modules.
  2. From the Modules in Repository list, select the modules required for the run book (shown in the list below), and then click Activate.
    1. AMP-AD-BMC-Remedy-ARS
    2. AutoPilot-AD-BMC_Atrium_CMDB
    3. AutoPilot-AD-Utilities
    4. AutoPilot-OA-Change_Management
    5. AutoPilot-OA-Common_Utilities
    6. AutoPilot-OA-Configuration_Management
    7. AutoPilot-OA-Incident_Management
    8. AutoPilot-OA-Task_Management
    9. BMC_BladeLogic-AD-Operations_Manager
    10. BladeLogic-SA-ITSM_Integration
    11. Closed_Loop_Server-SA-Audit
    12. Closed_Loop_Compliance-SA-Servers
    13. Closed_Loop_Compliance_ITSM_Integration
    14. Server_Incident-SA-Enrichment

You must configure the modules. For details on how to perform this task, see Updating-module-configuration-for-Continuous-Compliance-for-Server-Automation. 

If you modify the modules, you must export them to the repository to make the updated modules are available on the grid. Using the Import and Unbundle function in TrueSight Orchestration Development Studio, export the modules to the repository. If you import the modules directly from a local disk, they are not available to peers until you export them to the repository. For more information about exporting modules to a repository, see Administering in the TrueSight Orchestration online documentation.

Step 7: Configure TrueSight Server Automation templates and jobs for the solution

To use the BMC Continuous Compliance for Server Automation solution you must create the following items in the TrueSight Server Automation system, according to the use cases you want to implement.

To learn more about audit and compliance in TrueSight Server Automation, click here.

BMC Server Automation provides powerful compliance and audit analysis tools. The following table provides an overview of the compliance and audit analysis capabilities.

Topic

Description and more information

Compliance

Compliance analysis and remediation are performed based on BMC Server Automation components and component templates. Component templates contain the relevant compliance rules that you want your servers to adhere to, and components encapsulate just the right amount of server configuration to render your Compliance Jobs simple yet powerful.

  • To analyze operational compliance, you create custom component templates that contain the compliance rules for your internal corporate policies. Operational compliance involves tracking the properties of operating system objects, such as files, configurations, user accounts, or services.
  • To analyze regulatory compliance or security compliance, you use the prebuilt component templates offered by BMC. These templates facilitate compliance analysis when you must adhere to an industry-defined compliance policy, such as CIS, DISA, HIPAA, PCI, or SOX.
  • For additional information about building your compliance templates, see Working-with-components-and-component-templates in the BMC Server Automation online technical documentation.

Audit

Using Audit Jobs, you can:

  • Compare components, servers, or snapshots to determine if their configurations match a standard configuration.
  • Identify discrepancies between server configurations. When you identify discrepancies, you can bundle the necessary changes into a BLPackage and deploy those changes to a server so its configuration matches the standard configuration.
  • Perform a security function by quickly identifying unauthorized changes to server configurations.
  • Determine if a server configurations match a standard configuration. For more information about defining Audit Jobs, see Creating-Audit-Jobs in the TrueSight Server Automation online technical documentation.

Audit requirement

Performing an audit requires you to identify a master--that is, a server with a standard configuration that is used as the basis of comparison. The procedure for identifying a master depends on how you define an Audit Job.

  • If you define an Audit Job by selecting live server objects, you must select a server or a snapshot as the master server.
  • If you define an Audit Job by selecting one or more component templates, you must select one or more components or snapshots that act as a master.

Task

Description

Create new job properties

For the Closed Loop Server Audit and Closed Loop Server Compliance modules, you must add job properties for Batch and Deploy Job system objects in TrueSight Server Automation, as follows:

  1. From the Configuration menu, access the TrueSight Server Automation Console and select Property Dictionary View.
  2. Under Built-in Property Classes, expand the Jobs folder.
  3. Select the Batch Job system object.
  4. Click the Add New Property icon to add the CHANGE TICKET ID property.
  5. In the Add Property window:
    1. In the Name filed, enter CHANGE TICKET ID. 
      This property is used by the Closed Loop Server Audit module and Closed Loop Server Compliance module.
    2. Under Type, click Simple and select String.
    3. Click OK.
  6. Click the Add New Property icon to add the COMPLIANCE JOB NAME property.
  7. In the Add Property window:
    1. In the Name filed, enter COMPLIANCE JOB NAME.
      This property is used by the Closed Loop Server Compliance module. 
    2. Under Type, click Simple and select String.
    3. Click OK.
  8. Repeat the procedure for the Deploy Job system object.

Create an Audit component template

To create an audit component template

  1. Open the TrueSight Server Automation Console and select the Component Template workspace.
  2. Right-click a component templates folder, and select New > Component Template from the menu.
  3. In the Create New Component Template wizard, in the Create New Component Template (General) window:
    1. Provide a name, description and version (if applicable).
    2. In the Allowed Operations section, select Discover, Browse, Snapshot, and Audit.
    3. Click Next.
  4. In the Create New Component Template (Parts) window:
    1. Click the plus (+ ) sign to add parts to the template.
    2. Select one or more parts from the following objects:
      Servers
      Snapshot Jobs
      Local Config Files
      Local Extended Objects
      Local Server Objects
    3. Click OK to close the Add Part window. You can customize your preferences for each part by clicking the part. The preferences for the selected part appear in the Options section. Select or clear options as needed. Depending on the part selected, you might not have any options associated with that part.
    4. Click Next.
  5. In the Create New Component Template (Properties) window:
    1. Confirm that the component template properties you have selected are correct. To make changes, click Back to return to the previous step.
    2. Click Next.
  6. In the Create New Component Template (Permissions) window, click Finish. This window provides information about the access control list.

Create an Audit Job

The following are the requirements for creating the Audit Jobs used by the Closed Loop Server Audit module:

  • Component templates with identical names cannot be used in the same Audit Job.
  • The Audit Job must be configured to send SNMP traps for Job Run Notifications and not Audit Results Notifications. The Audit Job run notifications are sent when an Audit Job run is successful, fails, or is aborted.
  • The Send SNMP Trap to setting must be sent to the server name or IP address of your TrueSight Orchestration CDP server. However, the verification job must not send out a job completion notification.

To create the Audit Job:

  1. Start the TrueSight Server Automation Console, and select the Jobs workspace.

  2. Right-click the Jobs folder and select New > Job Folder to add a new job folder Audit Jobs. You can also use an existing folder to create the Audit Jobs.

    Note

    Ensure that the job folder locations match the location specified in the Closed Loop Server Audit module job group configuration items (Remediation_Job_Group) described in Updating run book module configurations.


  3. Select the Component Template workspace and select one audit template.
  4. Right-click the template and select Discover.
  5. In the New Component Discovery Job window, provide a job name, and Save in folder details and click Next.
  6. Specify the template, the target servers, and default notifications on the following wizard pages.
  7. On the Schedules page, select Execute Job Now and click Finish.
  8. After the Discovery Job executes successfully, select the Jobs workspace.
  9. Select the Audit Job folder, right-click and select New > Audit Job.

  10. In the New Audit Jobs (General) window:

    1. Provide a name and description for the Audit Job.
    2. Select a folder location to save the Audit Job.
    3. Under Select Audit Job Type, select Audit components.
    4. Under Number of Targets to Process in Parallel, select one of the following options:

      • Select Unlimited to run the job on as many targets as possible simultaneously.
      • Select Limited and specify a number in the field to the right. That number sets the maximum number of targets on which the job can run simultaneously.
    1. Click Next.
  11.  In the New Audit Jobs (Component Templates for Filtering) window:
    1. Select the component template that you used in step 3 for Audit Jobs.
    2. To add the selected template, use the > arrow button .
    3. Click Next.
  12. In the New Audit Jobs (Masters) window:
    1. Select the component of the Master server.
    2. Click Next.
  13. In the New Audit Jobs (Targets) window:
    1. Select the target server on which you want to execute the Audit Job.
    2. To add the selected target, use the > arrow button.
    3. Click Next.
  14. In the New Audit Jobs (Default Notification) window:
    1. Under Job Run Notifications, select Send SNMP trap to and enter the server name or IP address of your TrueSight Orchestration CDP server. The server that you enter must be a TrueSight OrchestrationCDP server with an SNMP Monitor adapter enabled.
    2. For the When status is option, select Success, Failed, and Aborted.
    3. Click Next.
  15. In the New Audit Jobs (Schedules) window:
    1. Select Execute job now or click the add icon (+ ) to set a schedule.
    2. To add a schedule, click the Schedule tab and select an option for scheduling the Audit Job run.
    3. Click OK.
    4. Click Next. (If you are not modifying default permissions, you can click Finish.)
  16. In the New Audit Jobs (Properties) window:
    1. Confirm the properties you have selected. To make changes, click Back to return to the previous step.
    2. Click Next.
  17. In the New Audit Jobs (Permissions) window:
    1. Confirm the information about your access control list.
    2. Click Finish. The Audit Job is created.

To create the Audit verification job

For each Audit Job you create, you must also create a corresponding Audit verification job that is used to verify the remediation job results. This Audit Job is used for the Verify Audit Discrepancies after Remediation workflow.

  1. Start the TrueSight Server Automation Console, and select the Jobs workspace.
  2. In the Audit folder, right-click the Audit Job you just created and select Copy.
  3. Paste the job into the Audit folder, and open the copied job file.
  4. On the General tab, rename the Copy of jobname file, adding the word Verify after the original Audit Job name. For example, if the name of the Audit Job is AuditJob, the audit verification file name must be AuditJobVerify.
  5. On the Default Notifications tab, remove all of the SNMP Job Run Notification settings.
  6. Save and close the audit verification job.

Create a Compliance component template

To create a compliance component template, complete the following steps:

  1. Open the TrueSight Server Automation Console and select the Component Template folder.
  2. Right-click a component templates folder, and select New > Component Template from the pop-up menu.
  3. In the Create New Component Template wizard, on the Create New Component Template (General) window:
    1. Provide a name, description and version (if applicable).
    2. In the Allowed Operations section, select Discover, Browse, Snapshot, Audit, Compliance, and Allow Auto-remediation (the Allow Remediation option is checked automatically).
    3. Click Next.
  4. In the Create New Component Template (Parts) window:
    1. Click the plus (+ ) sign to add parts to the template.
    2. Select one or more parts from the following objects:
      Servers
      Snapshot Jobs
      Local Config Files
      Local Extended Objects
      Local Server Objects
    3. Click OK to close the Add Part window. You can customize the preferences for each part by clicking the part. The preferences for the selected part appear in the Options section. Select or clear options as needed. Depending on what you select, there might not be any options associated with that part.
    4. Click Next.
  5. In the Create New Component Template (Properties) window:
    1. Confirm that the component template properties you have selected are correct. To make changes, click Back to return to the previous step.
    2. Click Next.
  6. In the Create New Component Template (Permissions) window, click Finish. Information about the access control list appears.
  7. To add a compliance rule for the template:
    1. Right-click the new component template and select Open.
    2. Select the Compliance tab.
    3. Do one of the following: 
      1. To add a new compliance rule, click Add New Compliance Rule.
      2. To edit an existing compliance rule, select the rule and click Edit Selected Item. 
        The Compliance Rule Editor panel opens.
    4. Define (or edit) the compliance rule through the tabs that appear at the bottom of the Compliance Rule Editor panel, according to the compliance rules for your internal corporate policies. For examples for adding compliance rules, see Examples for creating compliance rules in the TrueSight Server Automation online technical documentation.
    5. Click Save g_v95_saverules.gif after you have finished defining the rule.
  8. Switch back to the component template editor and click Save to save the component template.

Create a Compliance Job

  1. Start the TrueSight Server Automation Console, and select the Jobs workspace.

  2. Right-click the Jobs folder and select New > Job Folder to add a new job folder for Compliance Jobs. You can also use an existing folder to create the Compliance Jobs.

    Note

    Ensure that the job folder locations match the location specified in the Closed_Loop_Compliance-SA-Servers module job group configuration items (Remediation_Job_Group) described in Updating run book module configurations.


  3. Select the Component Template workspace and select one compliance template.
  4. Right-click and select Discover.
  5. In the New Component Discovery Job window, provide a name for the job and a location in the Save in folder field, and click Next.
  6. Specify the template, the target servers, and default notifications on the subsequent wizard pages.
  7. On the Schedules page, select Execute Job Now and click Finish.
  8. After the discovery job executes successfully, select the Jobs workspace.
  9. Select the Compliance Job folder, right-click, and select New > Compliance Job.
  10. In the New Compliance Jobs (General) window:
    1. Provide a name and description for the Compliance Job.
    2. Select the folder where you want to save the Compliance Job.
    3. Under Number of Targets to Process in Parallel, select Unlimited to run the job on as many targets as possible simultaneously.
    4. Click Next.
  11. In the New Compliance Jobs (Component Templates for Filtering) window:
    1. Select the component templates that form the basis of the Compliance Job.
      Note: For the template to appear on this panel, Compliance operations must be enabled for the template. If the template does not appear, open the template and select the Compliance check box on the General tab. For remediation settings to be enabled (in a subsequent step), select also the Allow Remediation and the Allow Auto-Remediation check boxes.
    2. Use the > arrow button to add the selected template.
    3. Click Next.
  12. In the New Compliance Jobs (Components) window:
    1. Select the servers on which you want to run the Compliance Job.
    2. Click Next.
  13. In the New Compliance Jobs (Auto-remediation) window:
    1. Select the Remediate after compliance analysis completes option to enable automatic remediation of any compliance rule failures that the Compliance Job discovers.
      Note: For this option to be available, the Allow Remediation and the Allow Auto-Remediation check boxes must be selected on the General tab of the component template (see Step 11 (a) for details).
    2. In the Remediation name field, enter a name for the remediation package.
    3. In the Save package in field, select a folder in which to save the remediation package (provided that you already associated a remediation package with the relevant rule, within rule definitions).
    4. In the Save remediation/deploy job in field, select a folder in which to save the Deploy Job for the remediation package.
    5. Click Next.
  14. In the New Compliance Jobs (Default Notification) window:
    1. Under Job Run Notifications, select Send SNMP trap to and enter the server name or IP address of your TrueSight Orchestration CDP server. The server that you enter must be a TrueSight Orchestration CDP server with an SNMP Monitor adapter enabled.
    2. For the When status is option, select Success, Failed, and Aborted.
    3. Click Next.
  15. In the New Compliance Jobs (Schedules) window, click Next to bypass the Schedules window.
  16. In the New Compliance Jobs (Properties) window, click Next to bypass the Properties window.
  17. In the New Compliance Jobs (Permissions) window, click Finish. The Compliance Job is created.
  18. To run the Compliance Job, right-click the job and select Execute. 

For an example procedure to create a Compliance Job, see Example-procedure-for-creating-a-Compliance-Job in the TrueSight Server Automation online technical documentation.

After the job completes, TrueSight Server Automation sends an SNMP trap for each inconsistent server-rule combination.

To create the Compliance verification job

  1. Start the TrueSight Server Automation Console, and select the Jobs workspace.
  2. In the Compliance folder, right-click the Compliance Job you created and select Copy.
  3. Paste the job into the Compliance folder, and open the copied job file.
  4. On the General tab, rename the Copy of jobname file, adding the word Verify after the original Compliance Job name. For example, if the name of the Compliance Job is ComplianceJob, the compliance verification file name must be ComplianceJobVerify.
  5. On the Default Notifications tab, remove all of the SNMP Job Run Notification settings.
  6. Save and close the compliance verification job.

Create a Compliance remediation Job

A remediation job consists of an instruction set and files required for implementing configuration changes. Configuration changes can consist of additions, deletions, and modifications to any of the server objects. 

Schedule the start date to:

  • Remediate a discrepancy or violation in BMC Remedy ITSM while approving the change request.
  • Schedule the TrueSight Server Automation remediation jobs.

For additional information, see About remediation packages and remediation jobs in the TrueSight Server Automation online documentation.

Only one package can exist for each rule in the Compliance component template. There might be some rules in the template that do not have an associated package.

  1. Start TrueSight Server Automation Console, and select the Depot workspace.
  2. Right-click the Depot folder and select New > BLPackage.
  3. In the Create BLPackage (Package Type) window:
    1. Type a name for the package.
    2. For the Save in field, click the Browse button and navigate to the Depot folder where you want to save the package.
    3. In the Create Package From section, select a method for creating a package, depending on your requirements.
    4. Click Next.
  4. In the Create BLPackage (Components) window:
    1. Click the add icon (+ ) to add one or more components to the remediation package.
    2. Select the components and click OK.
    3. Click Next.
  5. In the Create BLPackage (Package Options) window:
    1. Under the Depot Asset Options, check or uncheck Soft linked. By soft-linking the contents of a BLPackage, you can change the software or server objects referenced by the BLPackage without updating the BLPackage definition. Soft linking is only available for assets stored in the Depot.
    2. Under File Options, check any of the options of characteristics to control how files are managed when a BLPackage is created.
    3. Under Registry Options, check Collect access control list (ACL) attributes to instruct the BLPackage to gather ACLs for Windows registry entries. This option is available only if you are packaging registry information.
    4. Under Patch Package Options, check Include dependent packages to instruct the BLPackage to gather any patches that are prerequisites for the patches you have included in this BLPackage. 
      The BLPackage sequences patches according to their dependencies. This option is available only if you are packaging patches.
    5. Click Next.
  6. In the Create BLPackage (Properties) window, click Next.
  7. In the Create BLPackage (Permissions) window, click Finish to create the remediation package.

For more information about deploying the BLPackage, see Creating and modifying Software and BLPackage Deploy Jobs and Creating a Deploy Job in the TrueSight Server Automation online documentation.

Back to top

Where to go from here

After you have installed and configured the BMC Continuous Compliance for Server Automation solution, you can execute the Continuous Compliance for Servers use cases.

 

Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*