We use TEM to monitor compliance with configuration baselines like the CIS Checklists. We have a wide variety of operating systems throughout our environment, and have a policy which requires there to be a configuration baseline checklist for operating system in use.
What I am trying to do is generate a report which shows how many computers within our installation have no configuration baseline checklist. It would be nice to be able to drill into this report to retrieve information about that set of machines.
In Security Compliance Analytics I can easily see the number of computers associated with a given checklist, but I am trying to work out the remainder using the query and report functions available in Web Reports and SCA.
It is very helpful when you have an example output…
I think I can do it in 2 statements.
The first will return the checklists and their subscribed computers.
I assume that you have subscribe the appropriate computers to the respective sites.
(name of it, number of subscribed computers of it) of bes sites whose (name of it starts with
"CIS" or name of it starts with
"DISA")
The next statement will generate the last line of the number of computers without a check list.
We do this by taking the number of total computers - computers subscribing to at least one checklist.
number of bes computers - number of elements of set of subscribed computers of bes sites whose (name of it starts with
"CIS" or name of it starts with
"DISA")
We can then combine the 2 statements and put some HTML formatting code to make the output more readable.
You can create a simple but complete custom report by going to Web Reports --> Explore Data --> Custom --> paste the statement then Save Report
<?relevance (html
"<table border=1 style=%22border-collapse: collapse; border: medium none;%22>" & it & html
"</table>") of concatenation of ( trs of (td of name of it & td
"align=right" of (it as string) of number of subscribed computers of it) of bes sites whose (name of it starts with
"CIS" or name of it starts with
"DISA"); tr of (td of
"No Configuration Checklist" & td
"align=right" of (it as string) of (number of bes computers - number of elements of set of subscribed computers of bes sites whose (name of it starts with
"CIS" or name of it starts with
"DISA"))) ) ?>
Thank you that worked quite well. I modified your query slightly to include checklists beginning with “USGCB” as well. Works great. Thanks for your time.