Configuring Comply

If you did not install Comply with the Apply All Tanium recommended configurations option, you must enable and configure certain features.

Configure Comply

Configure the Comply action group

Importing the Comply module automatically creates an action group to target specific endpoints. If you did not use automatic configuration or you enabled restricted targeting when you imported Comply, the action group targets No Computers.

If you used automatic configuration and restricted targeting was disabled when you imported Comply, configuring the Comply action group is optional.

You must register sensors that are referenced by the action group. See Register or unregister sensors for collection.

You can update the action group if needed.

1. From the Tanium console, go to Administration > Actions > Action Groups.
2. Select Tanium Comply and click Edit to update the action group.

Set up Comply users

You can use the following set of predefined user roles to set up Comply users.

To review specific permissions for each role, see User role requirements.

On installation, Comply creates a Comply user to automatically manage the Comply service account. Do not delete the Comply user.

For more information about assigning user roles, see Tanium Core Platform User Guide: Manage role assignments for a user.

Comply Administrator

Assign the Comply Administrator role to users who manage the configuration and deployment of Comply functionality to endpoints.
This role can perform the following tasks:

• View and modify Comply configurations
• Create deployments to endpoints and update engines
• View and modify Comply standards

Comply Operator

Assign the Comply Operator role to users who manage the configuration and deployment of Comply functionality to endpoints.
This role can perform the following tasks:

• View and modify Comply configurations
• Create deployments to endpoints and update engines
• View and modify Comply standards

Comply Deployment Administrator

Assign the Comply Deployment Administrator role to users who create and view Comply endpoint configurations.
This role can perform the following tasks:

• Create deployments to endpoints and update engines
• View and modify Comply standards

Comply Report Content Administrator

Assign the Comply Report Content Administrator role to users who create and manage Comply compliance and vulnerability standards. This role can view and modify Comply standards.

Comply Report Administrator

Assign the Comply Report Administrator role to users who configure and manage Comply assessments.
This role can perform the following tasks:

• View and modify Comply assessments and reports
• View Comply standards

Comply Report Reviewer

Assign the Comply Report Reviewer role to users who review Comply assessments and standards.
This role can perform the following tasks:

• View Comply assessments and reports
• View Comply standards

Comply Custom Check Writer

Assign the Comply Custom Check Writer role to users who create custom checks to review a condition on endpoints that might not be included in any standard.
This role can perform the following tasks:

• View and modify custom checks
• View Comply standards

Comply RAS Assessment Creator

Assign the Comply RAS Assessment Creator role to a user to users who configure and manage remote authenticated scans.
This role can perform the following tasks:

• View and modify credentials
• View and modify RAS assessments

Comply Endpoint Configuration Approver

Assign the Comply Endpoint Configuration Approver role to a user who approves or rejects Comply configuration items in Tanium Endpoint Configuration. This role can approve, reject, or dismiss changes that target endpoints where Comply is installed.

Do not assign the Comply Service Account and Comply Service Account - All Content Sets roles to users. These roles are for internal purposes only.

Upload scan engines and JREs

A scan engine evaluates endpoints for security configuration exposures and software vulnerabilities using industry security standards, vulnerability definitions, and custom compliance checks.

In Comply, the scan engine evaluates Open Vulnerability Assessment Language (OVAL) or Security Content Automation Protocol (SCAP) content to determine endpoint compliance and vulnerability status. Comply generates findings based on the results of this evaluation by the scan engine.

At least one scan engine is required to use Comply. Comply 2.3 and later includes Tanium Scan Engine (powered by JovalCM) and Amazon Coretto Java Runtime Environment (JRE) versions 8.x and 11.x. Version 11.x is provided for use with supported Windows, Linux, and macOS endpoints. JRE version 11.0.15.9.1 and later also support Mac M1 and Amazon Linux 2 EC2. Most organizations can use the Tanium Scan Engine and Amazon Coretto JRE and do not need to upload any scan engines or JREs.

If needed, you can upload other scan engines to Comply. Comply supports the Tanium Scan Engine (which is included by default), SCC (used by the United States government), and CIS-CAT scan engines. The supported versions of the scan engines are listed in the Import Engine window and on this page: Reference: Supported engines and JREs. Typically, the most recent version plus the two previous versions are supported.

The Amazon Coretto JRE is not currently supported on some distributions of Linux, AIX, and Solaris. If you need to run a scan on an endpoint with one of these operating systems and do not want to use the existing JRE on the endpoint, you can upload it to Comply. For best results, use Comply to install a JRE (rather than using the existing JRE on the endpoint) so that you know which JRE is used to run scans.

Tanium Scan Engine and CIS-CAT also require PowerShell and do not work if PowerShell is in the ConstrainedLanguage language mode.

In the Configuration Progress section, click the Upload Engine/JRE step and then click Comply Engines to open the Manage Engines page. For more information about uploading engines and JREs from this page, see Uploading scan engines and JREs.

Create deployments

You must have the Comply Deployment Administrator role to create deployments. For more information about Comply roles, see User role requirements.

Create deployments based on the architecture and platform of the targeted endpoints to deploy engines and JREs to endpoints on a schedule. For example, you might want to create the following deployments:

• Windows 64-bit
• Windows 32-bit
• macOS 64-bit
• Linux 64-bit

For steps to create a deployment, see Setting up endpoints.

Restrict assessment visibility

By default, users with the Comply Assessment Reviewer role can see all assessments, even assessments that target computer groups for which the user does not have management rights.

If you want users to only see assessments that target computer groups for which they have management rights, set the assessment_mr_enabled setting to true. When you enable this setting, users can only see assessments when they have management rights to all computer groups that the assessment targets. If an assessments targets multiple computer groups, but the user does not have management rights to one or more of the targeted computer groups, the user cannot see the assessment.

1. From the Comply Overview page, click Settings .
2. Find the assessment_mr_enabled setting and click Edit.
   
3. In the Edit Setting window, enter true in the Value field.
   
   
4. Click Save.

The change takes effect immediately and does not require you to restart Comply.

Create assessments

From the Comply menu, click Assessments to open the Assessments page. From this page, you can create configuration compliance assessments, vulnerability assessments, and network unauthenticated assessments. You can also view and update existing assessments.

For information on assessments, see Creating compliance assessments and Creating vulnerability assessments.

Configure Comply for an air-gapped environment

When your Tanium Server is in an air-gapped environment, the server cannot download the Tanium Engines or Tanium Vulnerability Library files from the internet. You must configure Comply for an air-gapped environment and upload these files to Comply.

Starting with Comply 2.13, Tanium Vulnerability Library files on content.tanium.com support CVSS v3. If you are upgrading from a previous version and are in airgap mode, it is recommended that you upgrade to the latest TVL prior to upgrading to Comply 2.13. See Upload the Tanium Vulnerability Library files below for instructions.

1. From the Comply Home page, click Settings .
2. Find the is_airgapped setting and click Edit.
   
3. In the Edit Setting window, select True in the Value field.
   
   
4. Click Save.

You must restart Comply each time you change the value of the is_airgapped setting for the Tanium Vulnerability Library (TVL) to update properly.

Upload the Tanium Engines package

1. From the Comply menu, click Setup > Configuration and go to the Engines tab.
2. Click Upload Engines Package.
   
   
3. Download the air gap ZIP file from the following link indicated in the Upload Tanium Engines Airgap Archive window (https://content.tanium.com/files/published/comply-engines/engines2.cgz) using a machine that can connect to the internet and save it on the air-gapped machine.
   
   
4. Click Select Engines Package File, select the engines2.cgz file from the location where you saved it on the air-gapped machine, and click Open.

Starting with Comply 2.20.x, the file name has been updated to engines2.cgz. In previous versions, the file was called engines.cgz.

5. Click Upload.
6. After your upload is complete, click Close.

Upload the Tanium Vulnerability Library files

1. From the Comply menu, click Standards > Vulnerability to open the Vulnerability Standards page.
2. Click Upload Airgap Zip.
   
3. Download the air gap ZIP file from the link indicated in the Upload Tanium Standards Library Airgap Zip window (https://content.tanium.com/files/published/tvl/Comply-Standards-Airgap-v1.zip) using a machine that can connect to the internet and save it on the air-gapped machine.
   
4. Click Select File, select the Comply-Standards-Airgap-v1.zip file from the location where you saved it on the air-gapped machine, and click Open.
5. Click Upload.

By default, all file uploads must be smaller than 500 MB. You can increase this value by editing the max_request_payload_size_megabytes in Comply Settings . See Managing application settings.

6. After your upload is complete, click Close on the Upload Tanium Standards Library Airgap Zip window. Allow approximately five minutes for Comply to update the vulnerability standards. If you expand a vulnerability source, you will see the Type indicated as Local as well as a completed count of CVEs after the standards are successfully updated from the uploaded air gap ZIP file.

Configure credentials lists for remote-authenticated scans

In order for satellites to perform secure scans of endpoints without the Tanium Client installed, the login credentials for those endpoints are required. Following the instructions detailed here, add endpoint credentials for use in remote-authenticated scans.

The Comply Credential RBAC permission is required to configure credentials.

Use as few sets of credentials as possible for any credential lists used for satellite scans. Adding more credentials can increase the time necessary to complete a task as the task attempts each set of credentials. Additionally, the more credentials you use, the greater risk you run of credentials failing and possibly triggering security alerts or account lockouts.

1. From the Comply menu, click Setup > Credentials Lists. Click Create.
2. In the Summary section, configure the following:

• Enter a Name and Description for the credentials list.

• The Content Set is Comply. (This cannot be changed at this time.)
3. In the Credentials section, click Add.

Create separate credentials for each login service type.

4. In the Login Service section, select the connection method: WinRM, SSH or VMware API.

• If you are using WinRM credentials, do the following

  • (Optionally) Enter a Domain name.
  • Enter a Username.
  • Enter the corresponding Password.
  • Click Add.
• If you are using SSH credentials, do the following:
  • Select an Authentication Type: SSH Key (recommended) or Password.
    • For SSH, a Username and SSH Private Key are required. A Keyphrase is optional.
    • For Password, a Username and Password are required.
  • Expand Advanced Settings to optionally configure one or more of the following:

    The fields provided here allow the Tanium Scan Engine to perform compliance and vulnerability checks that require elevated privileges. The engine knows when it needs to use these additional privileges to gain access to endpoints. For example, on a Cisco Systems endpoint, there are configuration settings that require elevated privileges in order to read the value so that the Tanium Scan Engine can evaluate a compliance rule. If the Tanium Scan Engine requires these privileges for an endpoint and they are not provided here, it will return an error status for those rules, instead of pass or fail.

    • For Sudo Escalation, select the check box to indicate that the sudo command should be used for privilege escalation. If you enable the check box, and the authentication type is SSH Key, you must also enter a Password here.
    • For Cisco IOS Enable Password, enter the password for privilege elevation on Cisco IOS devices.
    • Under Substitute Credentials, enter a Substitute Name and Substitute Password, for su-based privilege escalation.
    • Click Add.
  • If you are using VMware API credentials, do the following:
    • Enter a Username. Must be the same username you enter for the VMware vCenter UI. Any username syntax that is supported by the vCenter UI is supported here. For example, domain names and Windows domain syntax are supported.
    • Enter a Password. Must be the same password you enter for the VMware vCenter UI.
    • Click Add.

    At this time, only connecting through a VMware vCenter application is supported. You cannot connect directly to an ESXi host.

5. Click Save on the Credentials page to preserve the endpoint credential criteria you added.

Prioritize credentials

Set the priority of credentials within a credentials list. This determines the order in which credentials are attempted on endpoints.

1. Click the Prioritize button.
2. Drag and drop items in the list to set their priority.

Once configured, select a credential list in the Assessments page when you choose Remote Authenticated as the Scan Method.

You cannot delete credentials that are used in an assessment.

Credentials list view

Once credentials are created, you can click the Additional data arrow from the list view to see information about the credentials such as date they were created or updated and the assessments in which the credentials are used.