• Policies and Profiles Guide
  • Policies
    • Control Policies
      • Creating Control Policies
      • Editing Basic Information, Scope, and Notes for a Policy
      • Copying a Policy
      • Deleting a Policy
      • Creating a New Policy Condition
      • Editing Policy Condition Assignments
      • Editing Policy Event Assignments
      • Assigning an Action to an Event
    • Compliance Policies
      • Creating a Compliance Policy
      • Creating a Compliance Condition to Check Host File Contents
      • Checking for Compliance
        • Scheduling a Compliance Check
        • Checking a Virtual Machine for Compliance from the Summary Screen
        • Checking a Host for Compliance from the Summary Screen
        • Checking a Replicator for Compliance from the Summary Screen
        • Checking a Pod for Compliance from the Summary Screen
        • Checking a Container Node for Compliance from the Summary Screen
        • Checking a Container Image for Compliance from the Summary Screen
  • Conditions
    • Creating a Condition
    • Editing a Condition
    • Copying a Condition
    • Deleting a Condition
  • Actions
    • Custom Actions
      • Creating an Assign Profile to Analysis Task Action
      • Creating a Snapshot Action
      • Deleting Snapshots by Age
      • Evaluating an Alert
      • Creating an Inherit Tag Action
      • Creating a CPU Reconfigure Action
      • Creating a Memory Reconfigure Action
      • Creating a Remove Tag Action
      • Creating an Ansible Playbook Run Action
      • Creating an E-mail Action
      • Creating an SNMP Action
      • Creating a Set Custom Attribute Action
      • Creating a Tag Action
    • Editing an Action
    • Deleting an Action
  • Policy Profiles
    • Creating Policy Profiles
    • Deleting a Policy Profile
    • Simulating Policy
      • Simulating Policy Profiles on Virtual Machines
    • Assigning Policy Profiles
      • Assigning Policy Profiles to an Infrastructure Provider
      • Removing Policy Profiles from an Infrastructure Provider
      • Assigning Policy Profiles to a Cluster
      • Removing Policy Profiles from a Cluster
      • Assigning Policy Profiles to a Host
      • Removing Policy Profiles from a Host
      • Assigning Policy Profiles to a Virtual Machine
      • Removing Policy Profiles from a Virtual Machine
      • Assigning Policy Profiles to a Resource Pool
      • Removing Policy Profiles from a Resource Pool
      • Assigning Policy Profiles to a Cloud Provider
      • Removing Policy Profiles from a Cloud Provider
      • Assigning Policy Profiles to a Network Provider
      • Removing Policy Profiles from a Network Provider
      • Assigning Policy Profiles to a Container Provider
      • Removing Policy Profiles from a Container Provider
      • Assigning Policy Profiles to a Replicator
      • Removing Policy Profiles from a Replicator
      • Assigning Policy Profiles to a Pod
      • Removing Policy Profiles from a Pod
      • Assigning Policy Profiles to a Container Node
      • Removing Policy Profiles from a Container Node
      • Assigning Policy Profiles to a Container Image
      • Removing Policy Profiles from a Container Image
      • Assigning Policy Profiles to an Instance
      • Removing Policy Profiles from an Instance
    • Disabling a Policy in a Policy Profile
    • Viewing Policy Simulation - Resultant Set of Policy (RSOP)
    • Exporting and Importing Analysis Profiles
• Appendix
• Events

Policies and Profiles Guide

Policies

Policies are used to manage your virtual environment. There are two types of policies available: compliance and control. Compliance policies are used to harden your virtual infrastructure, making sure that your security requirements are adhered to. Control policies are used to check for a specific condition and perform an action based on the outcome. For example:

• Prevent virtual machines from running without an administrator account.

• Prevent virtual machines from starting if certain patches are not applied.

• Configure the behavior of a production virtual machine to only start if it is running on a production host.

• Force a SmartState Analysis when a host is added or removed from a cluster.

Control Policies

A control policy is a combination of an event, a condition, and an action. This combination provides management capabilities in your virtual environment.

• An event is a trigger to check a condition.

• A condition is a test that is triggered by an event.

• An action is an execution that occurs if a condition is met.

Creating Control Policies

Create control policies by combining an event, a condition, and an action. Plan carefully the purpose of your policy before you create the policy. You can also use a scope expression that is tested immediately when the policy is triggered by an event. If the item is out of scope, then the policy does not continue on to the conditions, and none of the associated actions run.

This procedure describes how to create a control policy, its underlying conditions, and assign its events and actions in one process. Conditions and custom actions can be created separately as well. Those procedures are described in later sections in conditions and actions. Also, a description of all events is provided in events.

1. Browse to menu: Control > Explorer.

2. Click the Policies accordion, and select Control Policies.

3. Select either Host Control Policies or VM Control Policies or Replicator Control Policies or Pod Control Policies or Container Node Control Policies or Container Image Control Policies.

4. Click Configuration, Add a New Host / VM / Replicator / Pod / Node / Image Control Policy.

5. Type in a Description.

   

6. Uncheck Active if you do not want this policy to be processed even when assigned to a resource.

7. You can enter a Scope here (You can also create a scope as part of a condition, or not use one at all). If the host or virtual machine is not included in the scope, no actions are run.

8. In the Notes area, add a detailed explanation of the policy.

9. Click Add. You are brought to the page where you add conditions and events to your new policy.

   

10. Click Configuration to associate conditions, events, and actions with the policy.

Editing Basic Information, Scope, and Notes for a Policy

As your enterprise’s needs change, you can change the name of a policy or its scope. If the items that are being evaluated are out of scope, policy processing stops and no actions run.

1. Browse to menu: Control > Explorer.

2. Click the Policies accordion, and select the policy to edit.

3. Click Configuration, Edit Basic Info, Scope, and Notes.

4. In the Scope area, create a general condition based on a simple attribute. Or, click an existing expression to edit it. Based on what you choose, different options appear. Configuring a Scope is optional for a policy.

   

   • Click Field to create criteria based on field values.

     

   • Click Count of to create criteria based on the count of something, such as the number of snapshots for a virtual machine, or the number of virtual machines on a host.

     

   • Click Tag to create criteria based on tags that are assigned to your resources. For example, you can check the power state of a virtual machine or see whether it is tagged as production.

     

   • Click Find to seek a particular value, and then check a property. For example, finding the Admin account and checking that it is enabled. Use the following check commands:

     • Check Any: The result is true if one or more of the find results satisfy the check condition.

     • Check All: All of the find results must match for a true result.

     • Check Count: If the result satisfies the expression in check count, the result is true.

       

   • Click Registry to create criteria based on registry values. For example, you can check whether DCOM is enabled on a Windows System. Note that this applies only to Windows operating systems. Registry will only be available if you are editing a VM Control Policy.

     

5. Click Commit Expression Element Changes to add the scope.

6. In the Notes area, make the required changes.

7. Click Save.

Copying a Policy

You can copy a policy if its contents are similar to a new one that you want to create, then change the condition or event associated with it. This enables you to make new policies efficiently.

1. Navigate to menu: Control > Explorer.

2. Click the Policies accordion, and select the policy that you want to copy.

3. Click Configuration, and an option to copy the policy appears; for example, Copy this Image Policy.

   

4. Click OK to confirm.

The new policy is created with a prefix of Copy of in its description, and it can be viewed in the Policy accordion.

Deleting a Policy

You can remove policies that you no longer need. You can remove only the policies that aren’t assigned to a policy profile.

1. Browse to menu: Control > Explorer.

2. Click the Policies accordion, and select the policy that you want to remove.

3. Click Configuration, Delete this Host/VM and Instance/Replicator/Pod/Node/Image Policy.

4. Click OK to confirm.

Creating a New Policy Condition

If you have not created a condition to use with this policy, you can create one directly from inside the policy. A condition can contain two elements: a scope, and an expression. The expression is mandatory, but the scope is optional. A scope is a general attribute that is quickly checked before evaluating a more complex expression. You can create a scope at either the policy or condition level.

1. Browse to menu: Control > Explorer.

2. Click the Policies accordion, and select the policy that you want to create a new condition for.

3. Click Configuration, Create a new Condition assigned to this Policy.

4. Type in a Description for the condition. It must be unique to all the conditions.

   

5. Click Edit this Scope in the Scope area to create a general expression based on a simple attribute, such as operating system version. Based on what you choose, different options display. Scope is optional.

   • Click Field to create criteria based on field values.

     

   • Click Count of to create criteria based on the count of something, such as the number of snapshots for a virtual machine, or the number of virtual machines on a host.

     

   • Click Tag to create criteria based on tags that are assigned to your resources. For example, you can check the power state of a virtual machine or see whether it is tagged as production.

     

   • Click Find to seek a particular value, and then check a property. For example, finding the Admin account and checking that it is enabled. Use the following check commands:

     • Check Any: The result is true if one or more of the find results satisfy the check condition.

     • Check All: All of the find results must match for a true result.

     • Check Count: If the result satisfies the expression in check count, the result is true.

       

   • Click Registry to create criteria based on registry values. For example, you can check whether DCOM is enabled on a Windows System. This applies only to Windows operating systems. Registry is only available if you are creating a VM Control Policy.

     

6. Click Commit expression element changes to add the scope.

7. Click Edit this Expression in the Expression area. Based on what you choose, options display according to the choices that are presented in the Scope area.

8. Click Commit Expression Element Changes to add the expression.

9. In Notes, type in a detailed explanation of the condition.

10. Click Add.

The condition is created and is assigned directly to the policy. Note: The condition can be assigned to other policies.

Editing Policy Condition Assignments

Use this procedure to use a condition that was created either separately or as part of another policy. You can also remove a condition from a policy that no longer applies.

1. Browse to menu: Control > Explorer.

2. Click the Policies accordion, and select the policy that you want to assign conditions to.

3. Click Configuration, Edit this Policy’s Condition assignments.

4. From the Condition Selection area, you can assign conditions to the policy, remove all conditions from the policy, or remove specific conditions from the policy.

   

   • To add one or several conditions, select all the conditions that you want to apply from the Available Conditions box. Use Ctrl to add multiple conditions to a policy. Then, click Move selected Conditions into this Policy.

   • Click Remove all Conditions from this Policy to unassign any conditions from this policy.

   • To remove one or some conditions, select all the conditions that you want to remove from the Policy Conditions box. Use Ctrl to select multiple conditions. Then, click Remove selected Conditions from this Policy.

5. Click Save.

Editing Policy Event Assignments

The policy evaluates its scopes and conditions when specified events occur in your virtual infrastructure. This procedure helps you to select those events and the actions that occur based on the evaluation of the scopes and conditions for the policy.

1. Browse to menu: Control > Explorer.

2. Click the Policies accordion and select the control policy that you want to assign events to.

3. Click Configuration, Edit this Policy’s Event assignments.

4. Check all the events that you want to assign to this policy.

5. Click Save.

Assigning an Action to an Event

This procedure describes how to assign an action to an event.

1. Browse to menu: Control > Explorer.

2. Click the Policies accordion, and select the policy that you want to assign actions to.

3. From the Events area, click the description of the event you want to assign an action to.

4. Click Configuration, Edit Actions for this Policy Event.

5. Select all the appropriate actions from the Available Actions box, inside the Order of Actions if ALL Conditions are True. These are the actions that take place if the resources meet the Condition of the Policy.

   

   Note:

   Each selected action can be executed synchronously or asynchronously; synchronous actions will not start until the previous synchronous action is completed, and asynchronous action allows the next action to start whether the first action has completed or not. Also, at least one ManageIQ server in the ManageIQ zone must have the notifier server role that is enabled for the trap to be sent.

6. Click the add button , then:

   • Click the action, then click Set selected Actions to Asynchronous to make it asynchronous.

   • Click the action, then click Set selected Actions to Synchronous to make it synchronous. If creating a synchronous action, use the up and down arrows to identify in what order you want the actions to run.

7. Select all the actions from the appropriate Available Actions box, inside of the Order of Actions if ANY Conditions are False. These are the actions that take place if the resources do not meet the condition of the policy.

8. Click Save.

Compliance Policies

Compliance policies are designed to secure your environment by checking conditions that you create. These conditions can include the same conditions that you would use in a control policy, and most of the procedures are the same. However, a compliance policy automatically assigns the mark as a compliant action when the entity type (virtual machine or host, for example) to which the policy applies passes all of the conditions. If any of the conditions are not met, then the virtual machine or host is marked as non-compliant. The compliance status is shown in the summary screen for the entity type and on the compare and drift screens.

Creating a Compliance Policy

Create compliance policies by assigning or creating a condition. ManageIQ automatically assigns the events and actions to the compliance policy as opposed to a control policy where you must define this yourself. The entity type (VM or host, for example) compliance check event is assigned to the compliance policy. A compliance policy runs the mark as compliant action when the virtual machine or host passes all of the conditions. If any of the conditions are not met, then the virtual machine or host is marked as non-compliant.

Carefully plan the purpose of your policy before creating it. You can also use a scope expression that is tested immediately when the compliance check event triggers the policy. If the item is out of scope, then the policy does not continue on to the conditions, and none of the associated actions run.

1. Browse to menu: Control > Explorer.

2. Click the Policies accordion, and select Compliance Policies.

3. Select either Host Compliance Policies or VM Compliance Policies or Replicator Compliance Policies or Pod Compliance Policies or Container Node Compliance Policies or Container Image Compliance Policies.

4. Click Configuration, Add a new Compliance Policy.

5. Type in a Description for the policy.

   

6. Uncheck Active if you do not want this policy to be processed even when assigned to a resource.

7. You can enter a scope here. (You can also create a scope as part of a condition, or not use one at all.) If the host or virtual machine is not included in the scope, no actions run.

8. In the Notes area, add a detailed explanation of the policy.

9. Click Add.

You must add one or several conditions:

• You can create a new condition by clicking Configuration, Create a new Condition assigned to this Policy, as described in Creating a New Policy Condition.

• You can use an existing condition by clicking Configuration, Edit this Policy’s Condition assignments, as described in Editing Policy Condition Assignments.

By default, if any of the conditions are false, the virtual machine is marked as non-compliant. To add other actions, such as sending an email if the virtual machine fails the compliance test:

1. Click the Compliance Check event under the policy (exact name depends on entity type, for example VM Compliance Check.

2. Click Configuration, Edit Actions for this Policy Event.

3. Select Stop Virtual Machine and Send Email from the Available Actions area in Order of Actions if ANY conditions are False. (Mark as Non-Compliant should already be selected.)

   

4. Click Move selected Actions into this Event.

5. Click Add.

You can now make this part of a policy profile. After assigning the policy profile to the virtual machine, you can check it for its compliance status either on a schedule or on demand.

Creating a Compliance Condition to Check Host File Contents

ManageIQ Control provides the ability to create a compliance condition that checks file contents. Use this to be sure that internal operating system settings meet your security criteria. Regular expressions are used to create the search pattern. Test your regular expressions thoroughly before using them in a production environment.

Note that to search file contents you need to have collected the file using a host analysis profile.

1. Browse to menu: Control > Explorer.

2. Click the Conditions accordion, and select Host Conditions.

3. Click Configuration, Add a New Host Condition.

4. In Basic Information, type in a Description for the condition.

   

5. Editing the Scope area is not necessary for this procedure. Skip editing any Scope conditions.

6. If the Expression area is not automatically opened, click Edit this Expression, then edit the condition area to create a general condition based on a simple attribute. Based on what you choose, different options appear.

   • Click Find, then Host.Files : Name, and the parameters to select the file that you want to check.

   • Click Check Any, Contents, Regular Expression Matches, and type the expression. For example, if you want to make sure that permit root login is set to no, type ^\s*PermitRootLogin\s+no.

     

7. Click Commit expression element changes to add the expression.

8. In Notes area, type in a detailed explanation of the condition.

9. Click Add.

Checking for Compliance

After you have created your compliance policies and assigned them to a policy profile, you can check compliance in two ways. You can either schedule the compliance check or perform the check directly from the summary screen.

The compliance check runs all compliance policies that are assigned to the host or virtual machine. If the item fails any of the checks, it is marked as non-compliant in the item’s summary screen.

Note:

To schedule, you must have EvmRole-administrator access to the ManageIQ server.

Scheduling a Compliance Check

1. Click Configuration.

2. Click the Settings accordion, and select Schedules.

3. Click Configuration, Add a new Schedule.

4. In the Adding a new Schedule area, type in a name and description for the schedule.

   

5. Select Active if you want to enable this scan.

6. From the Action dropdown, select the type of compliance check you want to schedule. Depending on the type of analysis you choose, you are presented with one of the following group boxes:

   • If you choose VM Compliance Check, you are presented with VM Selection where you can choose to check all VMs, all VMs for a specific provider, all VMs for a cluster, all VMs for a specific host, a single VM, or you can select VMs by using a global filter.

     

   • If you choose Host Compliance Check, you are presented with Host Selection where you can choose to analyze all hosts, all hosts for a specific provider, all hosts for a cluster, a single host, or you can select hosts by using a global filter.

   • If you choose Container Image Compliance Check, you are presented with Image Selection where you can choose to analyze all images, all images for a specific provider, or a single image.

Note:

You can schedule a host analysis only for connected virtual machines, not repository virtual machines that were discovered through that host. Since repository virtual machines do not retain a relationship with the host that discovered them, there is no current way to scan them through the scheduling feature. The host is shown because it might have connected virtual machines in the future when the schedule is set to run.

1. From the Run menu, select how often you want the analysis to run. Your options after that depend on which run option you choose.

   

   • Select Once to have the analysis run just one time.

   • Select Hourly to run the analysis hourly. You’re prompted to select how many hours you want between each analysis.

   • Select Daily to run the analysis daily. You’re prompted to select how many days you want between each analysis.

   • Select Weekly to run the analysis weekly. You’re prompted to select how many weeks you want between each analysis.

   • Select Monthly to run the analysis monthly. You’re prompted to select how many months you want between each analysis.

2. Select the time zone for the schedule.

3. Type or select a date to begin the schedule in Starting Date.

4. Select a starting time based on a 24-hour clock in the selected time zone.

5. Click Add.

Checking a Virtual Machine for Compliance from the Summary Screen

1. Browse to menu: Compute > Infrastructure > Virtual Machines, select the virtual machine that you want to check for compliance.

2. Click Policy, and then Check Compliance of Last Known Configuration.

3. A confirmation message appears. Click OK.

4. To view the compliance history, click the virtual machine. Under Compliance, if History is Available, click it to see its compliance history.

   

Checking a Host for Compliance from the Summary Screen

1. Browse to menu: Compute > Infrastructure > Hosts, click the host that you want to check for compliance.

2. Click Policy, and then Check Compliance of Last Known Configuration or Analyze then Check Compliance.

3. To view the compliance history, click Available next to History.

   

Checking a Replicator for Compliance from the Summary Screen

1. Browse to menu: Compute > Containers > Replicators, select the replicator that you want to check for compliance.

2. Click Policy, and then Check Compliance of Last Known Configuration.

3. A confirmation message appears. Click OK.

4. . To view the compliance history, click the replicator. Under Compliance, if History is Available, click to see its compliance history.

   

Checking a Pod for Compliance from the Summary Screen

1. Browse to menu: Compute > Containers > Pods, select the pod that you want to check for compliance.

2. Click Policy, and then Check Compliance of Last Known Configuration.

3. A confirmation message appears. Click OK.

4. To view the compliance history, click the pod. Under Compliance, if History is Available, click to see its compliance history.

   

Checking a Container Node for Compliance from the Summary Screen

1. Browse to menu: Compute > Containers > Container Nodes**, click the node that you want to check for compliance.

2. Click Policy, and then Check Compliance of Last Known Configuration.

3. A confirmation message appears. Click OK.

4. To view the compliance history, click the node. Under Compliance, if History is Available, click to see its compliance history.

   

Checking a Container Image for Compliance from the Summary Screen

1. Browse to menu: Compute > Infrastructure > Container Images, select the container image that you want to check for compliance.

2. Click Policy, and then Check Compliance of Last Known Configuration.

3. A confirmation message appears. Click OK.

4. To view the compliance history, click the container image. Under Compliance, if History is Available, click to see its compliance history.

   

Conditions

Conditions are tests that are performed on attributes of virtual machines. A condition can contain two elements, a scope, and an expression. The expression is mandatory, but the scope is optional. A scope is a general attribute that is quickly checked before evaluating a more complex expression. For example, you might use a scope to check the operating system, and use an expression to check for a specific set of applications or security patches that only apply to the operating system referenced in the scope. If no conditions, scope, or expression, are defined for a policy, the policy is considered unconditional and returns a true value.

Creating a Condition

You can create a condition either from within a policy screen or by going directly to the expression editor in the ManageIQ console. You need to define a description and an expression element. The expression element defines what criteria you want to use to test the condition.

1. Browse to menu: Control > Explorer.

2. Click the Conditions accordion, and select either Host / Node Conditions or VM and Instance Conditions or Replicator Conditions or Pod or Node Conditions or Image Conditions.

3. Click Configuration, then Add a New Host / VM / Replicator / Pod / Node / Image Condition.

4. Enter a Description for the condition.

   

5. Click Edit this Scope in the Scope area to create a general condition based on a simple attribute. Based on what you choose, different options appear. Creating a scope is optional.

   

   • Click Field to create criteria based on field values.

     

   • Click Count of to create criteria based on the count of something, such as the number of network adapters on the host.

     

   • Click Tag to create criteria based on tags that are assigned to your resources. For example, you can check the power state of a virtual machine or see whether it is tagged as production.

     

   • Click Find to seek a particular value, and then check a property. For example, finding the Admin account and checking that it is enabled. Use the following check commands:

     • Check Any: The result is true if one or more of the find results satisfy the check condition.

     • Check All: All of the find results must match for a true result.

     • Check Count: If the result satisfies the expression in check count, the result is true.

       

   • Click Registry to create criteria based on registry values. For example, you can check whether DCOM is enabled on a Windows System. This applies only to Windows operating systems. Registry will only be available if you are creating a VM Condition.

     

6. Click Commit expression element changes to add the scope.

7. Click Edit this Expression in the Expression area to create a general condition based on a simple attribute. Based on what you choose, different options appear.

   • Click Field to create criteria based on field values.

     

   • Click Count of to create criteria based on the count of something, such as the number of snapshots for a virtual machine, or the number of virtual machines on a host.

     

   • Click Tag to create criteria based on tags assigned to your resources. For example, you can check the power state of a virtual machine or see whether it is tagged as production.

     

   • Click Find to seek a particular value, and then check a property. For example, finding the Admin account and checking that it is enabled. Use the following check commands.

     • Check Any: The result is true if one or more of the find results satisfy the check condition.

     • Check All: All of the find results must match for a true result.

     • Check Count: If the result satisfies the expression in check count, the result is true.

       

   • Click Registry to create criteria based on registry values. For example, you can check whether DCOM is enabled on a Windows System. This applies only to Windows operating systems.

     

8. Click Commit expression element changes to add the expression.

9. In Notes, type in a detailed explanation of the condition.

10. Click Add.

Editing a Condition

Edit a condition to add more expressions to it or modify its properties. You can edit conditions that you created.

1. Browse to menu: Control > Explorer.

2. Click the Conditions accordion, and click the condition that you want to edit.

3. Click Configuration, Edit this Condition.

4. Click in either the Scope or Expression area, and click the part of the condition to edit.

   

5. Make the edits for the current expression.

   • Click Commit expression element changes to add the changes.

   • Click Undo the previous change to cancel the last action executed.

   • Click Redo the previous change to repeat the previous action executed.

   • Click AND with a new expression element to create a logical AND with a new expression element.

   • Click OR with a new expression element to create a logical OR with a new expression element.

   • Click Wrap this expression element with a NOT to create a logical NOT on an expression element.

   • Click Remove this expression element to take out the current expression element.

6. When you complete all of the changes to the condition, click Save.

Copying a Condition

You can copy a condition to create a similar condition, then change the values that are associated with it. You can copy the sample conditions that are provided to customize them to your environment.

1. Browse to menu: Control > Explorer.

2. Click the Conditions accordion, and select the condition that you want to copy.

3. Click Configuration, Copy this Condition to a new Condition.

4. Make all the changes that you need for the new condition. The description must be unique to all conditions.

5. Click Add.

Deleting a Condition

Remove conditions that are no longer applicable. You can delete only the conditions that are not part of a policy. To be able to delete the condition, you must remove the policy first.

1. Browse to menu: Control > Explorer.

2. Click the Conditions accordion, and click the condition that you want to remove.

3. Click Configuration, Delete this VM and Instance Condition.

4. Click OK to confirm.

Actions

Actions are performed after the condition is evaluated. Control comes with a set of default actions that you can choose from. You can also create some of your own.

Default Actions and Descriptions

Custom Actions

You can create a custom action by using the ManageIQ console. Enter a description and action type. Procedures for each type of action are shown in the following sections. When you create a policy, you can associate actions with specific events.

Custom Actions and Descriptions

Creating an Assign Profile to Analysis Task Action

Use this action for assigning specific analysis profiles to virtual machines. You must create an analysis profile before assigning it to an action. You can only assign this action to an analysis start event.

1. Browse to menu: Control > Explorer.

2. Click the Actions accordion, then click Configuration, Add a new Action.

3. Type in a Description for the Action Type.

   

4. Select Assign Profile to Analysis Task from Action Type.

5. Select a profile from the Analysis profiles.

6. Click Add.

Creating a Snapshot Action

1. Browse to menu: Control > Explorer.

2. Click the Actions accordion, then click Configuration, Add a new Action.

3. Type in a Description for the action.

   

4. Select Create a Snapshot from Action Type.

5. Type in a Snapshot Name.

   

6. Click Add when you are finished.

Deleting Snapshots by Age

1. Browse to menu: Control > Explorer.

2. Click the Actions accordion, then click Configuration, Add a new Action.

3. Type in a Description for the action.

   

4. Select Delete Snapshots by Age from Action Type.

5. Select the age of snapshots to delete.

   

6. Click Add.

Evaluating an Alert

1. Browse to menu: Control > Explorer.

2. Click the Actions accordion, then click Configuration, Add a new Action.

3. Type in a Description for the action.

   

4. Select Evaluate Alerts from Action Type.

5. Select the alerts to be evaluated and click (Move selected Alerts into this Action). Use the Ctrl key to select multiple alerts.

   

6. Click Add.

Creating an Inherit Tag Action

1. Browse to menu: Control > Explorer.

2. Click the Actions accordion, and click Configuration, Add a new Action.

3. Type in a Description for the action.

   

4. Select Inherit Parent Tag from Action Type.

5. Select the type of parent item to inherit from in Parent Type.

6. Check all categories that you want inherited.

   

7. Click Add.

Creating a CPU Reconfigure Action

1. Browse to menu: Control > Explorer.

2. Click the Actions accordion, then click Configuration, Add a new Action.

3. Type in a Description for the action.

   

4. Select Reconfigure CPUs from Action Type.

5. Select a number from Number of CPUs.

   

6. Click Add.

Creating a Memory Reconfigure Action

1. Browse to menu: Control > Explorer.

2. Click the Actions accordion, then click Configuration, Add a new Action.

3. Type in a Description for the action.

   

4. Select Reconfigure Memory from Action Type.

5. Type in a new value for Memory Size.

   

6. Click Add.

Creating a Remove Tag Action

1. Browse to menu: Control > Explorer.

2. Click the Actions accordion, then click Configuration, Add a new Action.

3. Type in a Description for the action.

   

4. Select Remove Tags from Action Type.

5. Check the category of tags you want to remove.

   

6. Click Add.

Creating an Ansible Playbook Run Action

Use this action to run an Ansible Playbook against your inventory. You must first sync a playbook repository and add an Ansible Playbook service catalog item.

1. Browse to menu: Control > Explorer.

2. Click the Actions accordion, and click Configuration, Add a new Action.

3. Type in a Description for the action.

4. Select Run Ansible Playbook from Action Type.

5. Select the playbook catalog item to run from Playbook Catalog Item.

6. Check the inventory against which you run the Ansible playbook.

   • If Specific Hosts is selected, provide the IP or DNS names.

7. Click Add.

Creating an E-mail Action

To send emails from the ManageIQ server, you must have the notifier server role enabled and have defined settings for SMTP email.

1. Browse to menu: Control > Explorer.

2. Click the Actions accordion, then click Configuration, Add a new Action.

3. Type in a Description for the action.

   

4. Select Send an E-mail from Action Type.

5. Type in a From E-mail Address and To E-mail Address.

   

6. Click Add.

Creating an SNMP Action

To send SNMP traps from the ManageIQ server, you must have the Notifier server role and the SNMP daemons enabled.

1. Browse to menu: Control > Explorer.

2. Click the Actions accordion, then click Configuration, Add a new Action.

3. Enter a Description for the action.

4. Select Send an SNMP Trap from Action Type.

5. Type in the IP for the host to send the trap to, select the version of SNMP that you are using, and type in the Trap Object ID. Type in multiple hosts if you require the trap sent to multiple SNMP hosts.

   • If using SNMP V1, you are prompted for a Trap Number. Type 1, 2, or 3, based on the appropriate Suffix Number from table below.

   • If using SNMP V2, you are prompted for a Trap Object ID. Type info, warning, or critical, based on the table below.

     Object ID	Suffix Number Added to PEN	PEN with the Suffix Added
     info	1	1.3.6.1.4.1.33482.1
     warn, warning	2	1.3.6.1.4.1.33482.2
     crit, critical, error	3	1.3.6.1.4.1.33482.3

     Trap Object ID and Suffix Number

6. Type in the variables that you require in your message.

7. Click Add.

Note: When adding an SNMP action, be sure to set it as asynchronous.

Creating a Set Custom Attribute Action

The custom attribute must already exist in vCenter. See vCenter documentation for instructions. In this example, an attribute called ManageIQ policy already exists.

1. Browse to menu: Control > Explorer.

2. Click the Actions accordion, then click Configuration, Add a new Action.

3. Type in a Description for the action.

   

4. Select Set a Custom Attribute in vCenter from Action Type.

5. Type in the Attribute Name and Value to Set.

   

6. Click Add.

Creating a Tag Action

1. Browse to menu: Control > Explorer.

2. Click the Actions accordion, then click Configuration, Add a new Action.

3. Type in a Description for the action.

   

4. Select Tag from Action Type.

5. Click on the appropriate tag to apply from the list provided.

   

6. Click Add.

Editing an Action

Edit an action to modify its properties. You can’t edit any of the default actions that are supplied with ManageIQ. Only actions that you create can be changed.

Note: When you view an action, you can see what policies it is assigned to.

1. Browse to menu: Control > Explorer.

2. Click the Actions accordion, and then click the action that you need to edit.

3. Click Configuration, Edit this Action on the detail view of the action.

4. Make any required changes.

5. Click Save.

The action is modified and can be added to a policy. If the action is already party of a policy, the policy is automatically updated.

Deleting an Action

Delete unused actions to keep your environment uncluttered. You can’t delete default actions or actions that are currently assigned to a policy. The delete button is unavailable if the action is in use.

1. Browse to menu: Control > Explorer.

2. Click the Actions accordion, click the action that you need to remove.

3. Click Configuration, Delete this Action on the detail view of the tree.

4. Click OK to confirm.

Policy Profiles

Policy profiles are groups of policies that you can assign wholesale to virtual machines, providers, clusters, hosts, resource pools, replicators, pods, container nodes, and container images. Policy profiles provide a framework for easily managing and assigning different levels of security, across various types of cloud resources.

Creating Policy Profiles

1. Browse to menu: Control > Explorer.

2. Click on the Policy Profiles accordion, then click Configuration, then (Add a New Policy Profile).

3. In the Basic Information area, type in a unique description for the policy profile.

   

4. From Available Policies in the Policy Selection area select all the policies you need to apply to this policy profile. Use the Ctrl key to select multiple policies.

   

5. Click to add the Policies.

   

6. Add to the Notes area if required.

7. Click Add.

The policy profile is added. You can now assign the policy profile to providers, hosts, and repositories. In addition, you can verify that the virtual machine complies with the policy profile by using the Resultant Set of Policy feature.

Deleting a Policy Profile

Remove policy profiles that you no longer need. This doesn’t remove the policies that are associated with the policy profile.

1. Browse to menu: Control > Explorer.

2. Click the Policy Profile accordion, and then click the policy profile that you want to remove.

3. Click Configuration, Remove this Policy Profile.

4. Click OK to confirm.

Simulating Policy

Before assigning a policy profile to a virtual machine, use the ManageIQ controls policy simulation feature to determine if a virtual machine passes a policy profile.

Simulating Policy Profiles on Virtual Machines

1. Browse to menu: Compute > Infrastructure > Virtual Machines, select the virtual machines that you need to evaluate.

2. Click Policy, and then click Policy Simulation.

3. From the Select a Policy Profile to add dropdown, click the policy that you need to apply to the selected virtual machines.

   

4. The virtual machine thumbnail displays in the Policy Simulation area.

   • A check sign in the virtual thumbnail shows that the virtual machine passes policy.

   • A minus sign in the virtual thumbnail shows that the virtual machine fails policy.

5. Click a virtual machine in the Policy Simulation area to see its details.

6. Expand a policy profile by clicking it to see its member policies and the status of the conditions.

   • Check Show out of scope items to show all conditions, whether the virtual machine passes the scope part of the condition. Uncheck it to hide conditions where the scope part fails.

   • Next to Show policies, check Successful to show policies that are passed and check Failed to see the policies that have failed. The default is to show both.

   • Items in green text passed the condition.

   • Items in red text failed the condition.

   • Items in red italics failed the condition, but do not change the outcome of the scope.

If you evaluate multiple policy profiles, you can see both policy profiles and a tree expanding down to their conditions.

Assigning Policy Profiles

After creating your policy profiles, you are ready to evaluate and assign them.

• Assign a policy profile to a virtual machine to apply the policy profile to a specific virtual machine, independent of its related host, provider, or repository.

• Assign a policy profile to a provider to apply the policy profile to all virtual machines, hosts, replicators, pods, container nodes or container images registered to that provider.

• Assign a policy profile to a replicator to apply the policy profile to that specific replicator.

• Assign a policy profile to a pod to apply the policy profile to that specific pod.

• Assign a policy profile to a container node to apply the policy profile to that specific node.

• Assign a policy profile to a container image to apply the policy profile to that specific image.

• Assign a policy profile to a cluster to apply the policy profile to all virtual machines or hosts assigned to that cluster.

• Assign a VM policy profile to a host to apply the policy profile to that specific host or all virtual machines registered to that host.

• Assign a VM policy profile to a resource pool to apply the policy profile to all virtual machines or hosts assigned to that resource pool.

Assigning Policy Profiles to an Infrastructure Provider

1. Browse to menu: Compute > Infrastructure > Providers, verify the provider you need to assign the policy profiles to.

2. Click (Policy), and then click (Manage Policies).

3. From the Select Policy Profiles area, you can click on the triangle next to a desired policy profile to expand it and see its member policies.

4. Check the policy profiles you require to apply to the provider. It turns blue to show its assignment state has changed.

5. Click Save.

Removing Policy Profiles from an Infrastructure Provider

1. Browse to menu: Compute > Infrastructure > Providers, check the providers that you want to remove the policy profile from.

2. Click Policy, and then click Manage Policies.

3. Uncheck the policy profile that you need to remove. It turns blue to show that its assignment state changed.

4. Click Save.

Assigning Policy Profiles to a Cluster

1. Browse to menu: Compute > Infrastructure > Clusters, check the clusters that you need to assign policy profiles to.

2. Click Policy, and then click Manage Policies.

3. From the Select Policy Profiles area, you can click the triangle next to a desired policy profile to expand it and see its member policies.

4. Check the policy profiles that you need to apply to the cluster. It turns blue to show that its assignment state changed.

5. Click Save.

Removing Policy Profiles from a Cluster

1. Browse to menu: Compute > Infrastructure > Clusters, check the clusters that you need to remove the policy profiles from.

2. Click Policy, and then click Manage Policies.

3. From the Select Policy Profiles area, you can click the triangle next to a desired policy profile to expand it and see its member policies.

4. Uncheck the policy profiles that you need to remove. It turns blue to show that its assignment state changed.

5. Click Save.

Assigning Policy Profiles to a Host

1. Browse to menu: Compute > Infrastructure > Hosts, check the hosts that you need to assign policy profiles to.

2. Click Policy, and then click Manage Policies.

3. From the Select Policy Profiles area, click the triangle next to a desired policy profile to expand it and see its member policies.

4. Check the policy profiles that you need to apply to the host. It turns blue to show that its assignment state changed.

5. Click Save.

Removing Policy Profiles from a Host

1. Browse to menu: Compute > Infrastructure > Hosts, check the hosts that you need to remove the policy profiles from.

2. Click Policy, and then click Manage Policies.

3. Uncheck the policy profiles that you need to remove. It turns blue to show that its assignment state changed.

4. Click Save.

Assigning Policy Profiles to a Virtual Machine

1. Browse to menu: Compute > Infrastructure > Virtual Machines, check the virtual machines that you need to assign policy profiles to.

2. Click Policy, and then click Manage Policies.

3. From the Select Policy Profiles area, click the triangle next to a desired policy profile to expand it and see its member policies.

4. Check the policy profiles that you need to apply to the host. It turns blue to show that its assignment state changed.

5. Click Save.

Removing Policy Profiles from a Virtual Machine

1. Browse to menu: Compute > Infrastructure > Virtual Machines, check the virtual machines that you want to remove the policy profile from.

2. Click Policy, and then click Manage Policies.

3. Uncheck the policy profile that you need to remove. It turns blue to show that its assignment state changed.

4. Click Save.

Assigning Policy Profiles to a Resource Pool

1. Browse to menu: Compute > Infrastructure > Resource Pools, check the resource pools that you need to assign policy profiles to.

2. Click Policy, and then click Manage Policies.

3. From the Select Policy Profiles area, click the triangle next to a desired policy profile to expand it and see its member policies.

4. Click the policy profiles that you need to apply to the resource pools. It turns blue to show that its assignment state changed.

5. Click Save.

Removing Policy Profiles from a Resource Pool

1. Browse to menu: Compute > Infrastructure > Resource Pools, check the resource pools that you need to remove the policy profiles from.

2. Click Policy, and then click Manage Policies.

3. From the Select Policy Profiles area, click the triangle next to a desired policy profile to expand it and see its member policies.

4. Uncheck the policy profiles that you need to remove. It turns blue to show that its assignment state changed.

5. Click Save.

Assigning Policy Profiles to a Cloud Provider

1. Browse to menu: Compute > Clouds > Providers and check the provider that you need to assign the policy profiles to.

2. Click Policy, and then click Manage Policies.

3. From the Select Policy Profiles area, click the triangle next to a wanted policy profile to expand it and see its member policies.

4. Check the policy profiles that you need to apply to the provider. The ones that are different from the previous setting shows in blue.

5. Click Save.

Removing Policy Profiles from a Cloud Provider

1. Browse to menu: Compute > Clouds > Providers, check the providers that you need to remove the policy profile from.

2. Click Policy, and then click Manage Policies.

3. From the Select Policy Profiles area, click the triangle next to a desired policy profile to expand it and see its member policies.

4. Uncheck the policy profile that you need to remove. It turns blue to show that its assignment state changed.

5. Click Save.

Assigning Policy Profiles to a Network Provider

1. Browse to menu: Networks > Providers, check the network provider that you need to assign the policy profiles to.

2. Click Policy, and then click Manage Policies.

3. From the Select Policy Profiles area, click the triangle next to a wanted policy profile to expand it and see its member policies.

4. Check the policy profiles that you need to apply to the provider. The ones that are different from the previous setting shows in blue.

5. Click Save.

Removing Policy Profiles from a Network Provider

1. Browse to menu: Networks > Providers, check the network providers that you need to remove the policy profiles from.

2. Click Policy, and then click Manage Policies.

3. From the Select Policy Profiles area, click the triangle next to a desired policy profile to expand it and see its member policies.

4. Uncheck the policy profile that you need to remove. It turns blue to show that its assignment state changed.

5. Click Save.

Assigning Policy Profiles to a Container Provider

1. Browse to menu: Compute > Containers > Providers and select the provider that you need to assign the policy profiles to.

2. Click Policy, and then click Manage Policies.

3. From the Select Policy Profiles area, click the triangle next to a wanted policy profile to expand and see its member policies.

4. Select the policy profiles that you need to apply to the provider. It turns blue to show the selection.

5. Click Save.

Removing Policy Profiles from a Container Provider

1. Browse to menu: Compute > Containers > Providers, select the container providers that you need to remove the policy profiles from.

2. Click Policy, and then click Manage Policies.

3. From the Select Policy Profiles area, click the triangle next to a desired policy profile to expand it and see its member policies.

4. Uncheck the policy profile that you need to remove. It turns blue to show that its assignment state changed.

5. Click Save.

Assigning Policy Profiles to a Replicator

1. Browse to menu: Compute > Containers > Replicators and select the replicator that you need to assign the policy profiles to.

2. Click Policy, and then click Manage Policies.

3. From the Select Policy Profiles area, click the triangle next to a wanted policy profile to expand and see its member policies.

4. Select the policy profiles that you need to apply to the replicator. It turns blue to show the selection.

5. Click Save.

Removing Policy Profiles from a Replicator

1. Browse to menu: Compute > Containers > Replicators, select the replicators that you need to remove the policy profiles from.

2. Click Policy, and then click Manage Policies.

3. From the Select Policy Profiles area, click the triangle next to a desired policy profile to expand it and see its member policies.

4. Uncheck the policy profile that you need to remove. It turns blue to show that its assignment state changed.

5. Click Save.

Assigning Policy Profiles to a Pod

1. Browse to menu: Compute > Containers > Pods and select the pod that you need to assign the policy profiles to.

2. Click Policy, and then click Manage Policies.

3. From the Select Policy Profiles area, click the triangle next to a wanted policy profile to expand and see its member policies.

4. Select the policy profiles that you need to apply to the pod. It turns blue to show the selection.

5. Click Save.

Removing Policy Profiles from a Pod

1. Browse to menu: Compute > Containers > Pods, select the pods that you need to remove the policy profiles from.

2. Click Policy, and then click Manage Policies.

3. From the Select Policy Profiles area, click the triangle next to a desired policy profile to expand it and see its member policies.

4. Uncheck the policy profile that you need to remove. It turns blue to show that its assignment state changed.

5. Click Save.

Assigning Policy Profiles to a Container Node

1. Browse to menu: Compute > Containers > Container Nodes and select the container node that you need to assign the policy profiles to.

2. Click Policy, and then click Manage Policies.

3. From the Select Policy Profiles area, click the triangle next to a wanted policy profile to expand and see its member policies.

4. Select the policy profiles that you need to apply to the node. It turns blue to show the selection.

5. Click Save.

Removing Policy Profiles from a Container Node

1. Browse to menu: Compute > Containers > Container Nodes**, select the container nodes that you need to remove the policy profiles from.

2. Click Policy, and then click Manage Policies.

3. From the Select Policy Profiles area, click the triangle next to a desired policy profile to expand it and see its member policies.

4. Uncheck the policy profile that you need to remove. It turns blue to show that its assignment state changed.

5. Click Save.

Assigning Policy Profiles to a Container Image

1. Browse to menu: Compute > Containers > Container Images and select the image that you need to assign the policy profiles to.

2. Click Policy, and then click Manage Policies.

3. From the Select Policy Profiles area, click the triangle next to a wanted policy profile to expand and see its member policies.

4. Select the policy profiles that you need to apply to the image. It turns blue to show the selection.

5. Click Save.

Removing Policy Profiles from a Container Image

1. Browse to menu: Compute > Containers > Container Images, select the container images that you need to remove the policy profiles from.

2. Click Policy, and then click Manage Policies.

3. From the Select Policy Profiles area, click the triangle next to a desired policy profile to expand it and see its member policies.

4. Uncheck the policy profile that you need to remove. It turns blue to show that its assignment state changed.

5. Click Save.

Assigning Policy Profiles to an Instance

1. Browse to menu: Compute > Clouds > Instances, check the instances that you want to assign policy profiles to.

2. Click Policy, and then click Manage Policies.

3. From the Select Policy Profiles area, click the triangle next to a wanted policy profile to expand it and see its member policies.

4. Check the policy profiles that you want to apply to the instances. It turns blue to show that its assignment state changed.

5. Click Save.

Removing Policy Profiles from an Instance

1. Browse to menu: Compute > Clouds > Instances, check the instances that you need to remove the policy profile from.

2. Click Policy, and then click Manage Policies.

3. From the Select Policy Profiles area, click the triangle next to a desired policy profile to expand it and see its member policies.

4. Uncheck the policy profile that you need to remove. It turns blue to show that its assignment state changed.

5. Click Save.

Disabling a Policy in a Policy Profile

You can disable one policy in a profile without removing it from the policy, perhaps for trouble shooting purposes or because the policy is not required temporarily.

1. Browse to menu: Control > Explorer.

2. Click the Policies accordion, then navigate to the policy that you need to disable or navigate to the policy from the policy profile.

3. Click Configuration, Edit Basic Info, Scope, Notes.

4. Uncheck Active.

5. Click Save.

Viewing Policy Simulation - Resultant Set of Policy (RSOP)

After the Policy Profiles are assigned, you can see the final result of the resolution of all policies based on which Events occur. Based on the result, you can adjust your Policies. To view RSOP, go to the control area in the ManageIQ console.

1. Browse to menu: Control > Simulation.

2. From the Event Selection area, select a type of event, and then the specific event you need the result for.

   

3. From the VM Selection area, select the virtual machine from a provider, cluster, host, or a single virtual machine.

   

4. Click Submit.

Exporting and Importing Analysis Profiles

ManageIQ SmartState analysis requires an analysis profile to select the files to be scanned by a compliance policy. ManageIQ allows the export and import of SmartState analysis profiles by using the command line and rake commands. As a result, approved configurations can be easily imported into customer environments, without having to manually recreate the profile through the user interface.

1. Change to the vmdb directory:

    cd /var/www/miq/vmdb
   

2. Create an export directory:

    $ mkdir exports
   

3. To export an analysis profile, run:

    bundle exec rake evm:export:scan_profiles -- --directory exports
   

4. To import the default analysis profile, run:

    bundle exec rake evm:import:scan_profiles -- --source exports/host_default.yaml
   

   Note:

   If the default profile exists in ManageIQ, the new profile does not overwrite the old profile. Instead, it duplicates the file items in the default profile.

Appendix

Events

Events are triggers that cause a condition to be tested. Control provides several Events, that can be divided into functional types. Events cannot be modified.

Event Types

Each type has a set of events that you can select to trigger the checking of a condition.

Events and Descriptions