Compliance Action Rules - Check Point HARMONY R81 Administration Manual

Compliance Action Rules

Many of the Compliance Policy actions contain Action Rules that include these components:
n Check Objects (Checks) - Check objects define the actual file, process, value, or
condition that the Compliance component looks for.
n One or more Remediation objects - A Remediation object runs a specified application or
script to make the endpoint computer compliant. It can also send alert messages to
users.
n One of these Action options - What happens when a computer violates the rule:
Action
Observe
Warn
Restrict
The Compliance component runs the rules. If it finds violations, it runs the steps for
Remediation and does the Action in the rule.
Some Action Rules are included by default. You can add more rules for your environment.
Basic Workflow for defining additional compliance rules:
1. In the Policy tab, right-click an action in the Actions column and select Edit Properties.
2. Click Create Rule to create new Action Rules as necessary:
a. In the Name field, enter the Action rule name.
b. Click Check to add Check objects to add to the Action
Objects" on the next page
c. Select an Action from the list.
Definition
Log endpoint activity without further action. Users do not know that they
are non-compliant. Non-compliant endpoints show in the Observe state
in the Reporting tab.
Alerts the user about non-compliance and automatically does the
specified Remediation steps.
Send a log entry to the administrator.
Alerts the user about non-compliance and automatically does the
specified Remediation steps.
Send a log entry to the administrator.
Changes applicable polices to the restricted state after a pre-defined
number of heartbeats (default =5). Before this happens, the user is in
the about to be restricted state. On the monitoring tab, the user is shown
as pre-restricted.
.
R81 Harmony Endpoint Server Administration Guide | 360
Compliance Action Rules
"Compliance Check