The Compliance Engine evaluates compliance at multiple levels, from individual conditions up to overall device compliance. Each level’s status depends on the combined results of the levels beneath it. This hierarchy ensures that a single failing condition can propagate to affect the overall device compliance.
While the device-level evaluation focuses on the compliance status of individual devices, the preset-level evaluation aggregates these results across all targeted devices within a preset.
Evaluation level | What It Represents | Scope |
|---|---|---|
Device Compliance Status | Overall compliance status of a device across all Compliance presets. | One device, all presets |
Device Preset Result | Evaluation of all rules within a preset for one specific device. | One device, one preset |
Device Rule Result | Evaluation of all conditions in a rule for one specific device. | One device, one rule |
Device Condition Result | Evaluation of a single condition on a single device. | One device, one condition |
Each level’s result is determined by the combined results of the levels beneath it. See the hierarchy diagram below:
The table below summarizes all possible status combinations for each evaluation level. For each row, the status is calculated based on the combined results from the level directly below it:
Device Condition Result: determined by the actual condition evaluation on the device.
Device Rule Result: determined by the combined result of the device conditions for the device within the rule.
Device Preset Result: determined by the combined result of device rule results for the device within the preset.
Device Compliance Status: determined by the combined result of all the device preset results for the device.
Example: A device preset result can be Partially Executed in any of these scenarios:
At least one device rule result is Partially Executed or Not Executed and the rest are Successful.
All device rule results are Partially Executed.
The device rule results are a combination of Missing Source + Not Executed.
The device rule results are a combination of Invalid Source + Not Executed.
| Compliant / Successful | Non-Compliant / Failed | Partially Executed | Missing Source | Invalid Source | Not Executed | Unmanaged* | Disabled |
|---|---|---|---|---|---|---|---|---|
Device Compliance Status | Compliant if all device preset results = Compliant | Non-Compliant if ≥1 device preset result = Non-Compliant | • ≥1 device preset result = Not Executed, others = Successful / Invalid Source / Partially Executed / Missing Source • ≥1 device preset result = Partially Executed, others = Successful / Invalid Source/ Missing Source • All device preset results = Partially Executed | All device preset results = Missing Source | • All device preset results = Invalid Source • ≥1 device preset result = Invalid Source, others = Missing Source + Successful | All device preset results = Not Executed | All device preset results = Unmanaged | — |
Device Preset Result | Compliant if all device rule results = Successful | Non-Compliant if ≥1 device rule result = Failed | • ≥1 device rule result = Partially Executed or Not Executed, others = Successful • All device rule results = Partially Executed • Combination of Missing Source + Not Executed device rule results • Combination of Invalid Source + Not Executed device rule results | All device rule results = Missing Source | All device rule results = Invalid Source | All device rule results = Not Executed | All device rule results = Unmanaged | — |
Device Rule Result | • AND operator: Successful if all conditions are Successful • OR operator: Successful if ≥1 condition = Successful, others Failed / Not Executed | • AND: Failed if ≥1 condition = Failed • OR: Failed if all conditions = Failed | • AND operator: ≥1 device condition result = Successful, others = Not Executed • OR operator: ≥1 device condition result = Not Executed, others = Failed • Combination of Missing Source + Not Executed device condition results • Combination of Invalid Source + Not Executed device condition results | All device condition results = Missing Source | All device condition results = Invalid Source | All device condition results = Not Executed | All device condition results = Unmanaged | Rule is disabled |
Device Condition Result | Successful if condition passed on device | Failed if condition failed on device | — | Required source unavailable | Preset source = Config search & search performed on not the latest device's backup | Condition not yet evaluated on device | Device is unmanaged | Rule is disabled |
* - Only when unmanaged device evaluation is disabled
Evaluation level | What It Represents | Scope |
|---|---|---|
Preset Status | Result of evaluating an entire Compliance preset across all its target devices. | All devices targeted, one preset |
Rule Status | Result of evaluating one Compliance rule across all target devices in a preset. | All targeted devices, one rule |
Condition Status | Result of evaluating one Compliance condition across all target devices in a preset. | All targeted devices, one condition |
Each level’s result is determined by the combined results of the levels beneath it. See the hierarchy diagram below:
The table below summarizes all possible status combinations for each evaluation level. For each row, the status is calculated based on the combined results from the level directly below it:
Condition Status: determined by the combined result of all the device condition results for the specific condition.
Rule Status: determined by the combined result of all the device rule results for the specific rule.
Preset Status: determined by the combined result of all the device preset results for the specific preset.
Example: A preset status can be Partially Executed in any of these scenarios:
At least one device preset result is Partially Executed and the rest are Successful Missing Source or Invalid Source.
At least one device preset result is Not Executed and the rest are Successful, Partially Executed, Missing Source or Invalid Source.
All device preset results are Partially Executed.
| Compliant / Successful | Non-Compliant / Failed | Partially Executed | Missing Source | Not Invalid Source | Not Executed | Unmanaged* | Disabled |
|---|---|---|---|---|---|---|---|---|
Preset Status | Compliant if all device preset results are Compliant | Non-Compliant if ≥1 device preset result is Non-Compliant | • ≥1 device preset result = Partially Executed, others = Successful / Missing Source / Invalid Source • ≥1 device preset result = Not Executed, others = Successful / Partially Executed / Missing Source / Invalid Source • All device preset results = Partially Executed | • All device preset results = Missing Source • ≥1 device preset result = Missing Source, others = Successful | • All device preset results = Invalid Source • ≥1 device preset result = Invalid Source, others = Successful / Missing | • All device preset results = Not Executed • Preset has no conditions | All device preset results = Unmanaged | — |
Rule Status | Successful if all device rule results = Successful | Failed if ≥1 device rule result = Failed | • All device rule results = Partially Executed • ≥1 device rule result = Partially Executed, others = Successful / Missing Source / Invalid Source • ≥1 device rule result = Not Executed, others = Successful / Partially Executed / Missing Source / Invalid Source | • All device rule results = Missing Source • ≥1 device rule result = Missing Source, others = Successful | • All device rule results = Invalid Source • ≥1 device rule result = Invalid Source, others = Successful / Missing Source | • All device rule results = Not Executed • Rule has no conditions
• Rule was created/modified but never executed | — | Rule is disabled |
Condition Status | Successful if all device condition results = Successful | Failed if ≥1 device condition result = Failed | ≥1 device condition result = Not Executed, others = Successful / Missing Source / Invalid Source | • All device condition results = Missing Source • ≥1 device condition result = Missing Source, others = Successful | • All device condition results = Invalid Source • ≥1 device condition result = Invalid Source, others = Missing Source/ Successful | All device condition results = Not Executed | Parent rule disabled | Rule is disabled |
* - Only when unmanaged device evaluation is disabled