BigFix Compliance: SCM Checklist Updates for Scan Exclusions, DISA IDs, and Environment Setup Task

Release Announcements Compliance (Release Announcements)
1

Product: BigFix Compliance

Title: BigFix Compliance: SCM Checklist Updates for Scan Exclusions, DISA IDs, and Environment Setup Task

We have released three updates to BigFix Compliance SCM checklists, covering scan exclusion, task reliability, and reporting accuracy. This post gives a brief overview of each, with documentation links where available.

Note: These changes will be applied to checklists published going forward. Checklists that are already published will be updated during the next refresh.

1. Persistent scan exclusions for the Deploy and Run Scan task (Linux checklists)

For Linux checklists, you can now configure and store scan exclusions directly on the endpoint, so they are reused across scan runs without re-entering them each time. Two new tasks, Add Scan Exclusions and Remove Scan Exclusions, let you manage exclusions for directories, mount points, filesystem types, and the inode threshold. Saved values are applied automatically on later scans, and the Take Action inputs are used when no saved value exists.

For details, see Modifying global scan options

2. Corrected DISA STIG ID and DISA CCI ID (STIG checklists)

We have corrected the DISA STIG ID and DISA CCI ID metadata for STIG checklists. Previously, the DISA STIG ID showed inaccurate data and the DISA CCI ID was blank, both in SCA and in the check description in the console. This has been fixed so the values now reflect the correct data from the DISA benchmark. In SCA, the DISA CCI ID column shows the CCI ID, the DISA VulId (STIG ID) column shows the STIG ID, and the Source ID column shows the Vulnerability ID. The same information is available in the check description in the console. This makes it easier to cross-reference findings against external scanners and DISA guidance.

3. More reliable Environment Setup task (Middleware and NIX checklists)

For Middleware and NIX checklists, the Environment Setup task now uses an atomic results refresh. Previously, the task removed the existing results before generating new ones, which could briefly cause checks to report as Non-Compliant or Not Applicable if the client evaluated during that window. The task now keeps the existing results until the new results are fully generated, then swaps them in, so a valid set of results is always available. Each result also carries a timestamp showing when it was collected.

For details, see Environment Setup Task

More information

To learn more about BigFix Compliance SCM checklists, see the BigFix Forum: https://forum.bigfix.com/c/release-announcements/scm-checklists/86

We hope you find these improvements useful, and we welcome your feedback.

The BigFix Compliance team

2

Thanks for the improvements. Especially point 3. sounds great for me. Is my assumption correct that all environment setup tasks will get an update and running policy actions for these tasks will need to be rescheduled?

1 Like
3

Thanks for your feedback.

To clarify, the change will not update all existing Environment Setup Tasks immediately. As mentioned in the announcement, the changes will be applied to newly published checklists going forward, while already published checklists will receive the update during their next refresh.

When a checklist is refreshed, the Environment Setup Task will be updated to use the new approach. In that case, you will need to:

  • Stop the scheduled Environment Setup Task.
  • Gather Latest Site and Sync with Your Custom Site.
  • Once the synchronization completes successfully, reschedule the Environment Setup Task.

Therefore, not all Environment Setup Tasks will need to be rescheduled immediately. Only checklists that receive the update during a refresh will require these steps.

1 Like