You can use the Secure Configuration Manager delta reporting feature for comparing report results to easily identify and monitor changes to systems. For example, if you regularly run a policy template, you can observe changes to an endpoint’s results from run to run. You can also compare a known, good endpoint’s results against those of another endpoint for the same policy template run. Similarly, you can compare the results of two endpoints from a single security check run.
Since delta reports compare specific data fields, those fields must match in the two reports you want to compare. Therefore, you can run delta reports only for security check and policy template reports generated for endpoints managed by the same agent version. Also, if a security check was edited between runs, Secure Configuration Manager can only compare the unchanged fields in the check.
You can schedule a delta report to run on a recurring basis. You can also distribute a delta report using email or save it to a folder or file share. For more information about the Delta Comparison wizard, see the Help.
The Delta Comparison View in the delta report can indicate both a change in the managed risk at the security check level and differences in the endpoint results. That is, when you select Security Checks at the top level of the view, the report might indicate “Unchanged” because the overall scoring for the endpoints did not change for the selected runs. For example, information-only security checks always indicate “Unchanged” at the top level of the view because the managed risk value does not vary with endpoint results. However, the data results for individual endpoints might have changed between runs. To view whether endpoint results changed, you must expand the selected check in the navigation pane of the Delta Comparison View. The content pane then lists endpoint results, such as “Added” or “Deleted” if a change occurred between runs.
Once you run a security check against a group of endpoints, you can create delta reports to compare the security check’s results for two of those endpoints. For example, you may have a known, good endpoint to use as a base to compare a newer, unknown endpoint.
To create a delta report comparing two endpoints:
In the left pane, click Job Queues.
In the Job Queues tree pane, select Completed.
In the content pane, select the report for which you want to compare runs.
In the bottom of the content pane, click the Endpoints tab.
Hold down Shift or Ctrl and select the two endpoints you want to compare.
Right click the selections, then click Run Delta Report.
Follow the instructions in the wizard to run the report.
(Optional) To include specific data in the Delta Report, click the Layout tab in the Report Options window and select the boxes for Same or Different. For more information, see Section 5.3.3, Filtering a Delta Report.
To view the report, double-click the report name in the Completed jobs queue.
When you compare policy template results, you can observe changes to an endpoint’s results from run to run. You also can compare the results for a known, good endpoint against those of another endpoint for the same policy template run.
NOTE:To create, schedule, or distribute a delta report for a policy template, at least one run of the policy template must be complete.
Secure Configuration Manager provides two methods for running a delta report to compare policy template results: from the Run Policy Template wizard and from completed report in the Completed jobs queue. If you only have one run of the policy template, you can enable delta reporting as you set up another run of the policy template. Also, you can schedule automatic runs of the delta report from the Run Policy Template wizard. Alternatively, if you only need one delta report and already have two or more completed runs of the same policy template, you can generate the delta report from the Completed jobs queue.
To create a delta report comparing policy template results:
(Conditional) If two runs of the policy template are complete, complete the following steps:
In the left pane, click Job Queues.
In the Job Queues tree pane, select Completed.
In the content pane, select the policy template report for which you want to compare runs.
In the bottom of the content pane, click the All Runs of this Report tab.
Hold down Shift or Ctrl and select the two report runs you want to compare.
Right-click the selections, then click Run Delta Report.
Follow the instructions in the wizard to run the report.
(Optional) To include specific data in the Delta Report, click the Layout tab in the Report Options window and select the boxes for Added, Deleted, Modified, or Unchanged. For more information, see Section 5.3.3, Filtering a Delta Report.
Click Finish.
(Conditional) If only one run of the policy template is complete, complete the following steps:
In the left pane, click IT Assets.
In the IT Assets tree pane, expand Managed Groups and select the same managed group or individual endpoints that the previous run of the policy template ran against.
Right-click the group or endpoints, then click Run Policy Template.
Follow the instructions in the wizard, ensuring you select the same policy template.
On the Delta Reporting window, select Enable Delta Reporting.
Click Setup.
Follow the instructions in the Delta Comparison wizard.
(Optional) If you want to include specific data in the Delta Report, click the Layout tab in the Report Options window and select the boxes for Added, Deleted, Modified, or Unchanged. For more information, see Section 5.3.3, Filtering a Delta Report.
Click Finish.
Follow the remaining instructions in the Run Policy Template wizard.
To view the report, double-click the report name in the Completed jobs queue.
When comparing policy templates, you can specify whether the delta report includes added, modified, deleted, or unchanged data. Alternatively, if you compare endpoints, you can specify whether you want to include data that is the same or different between the endpoints. You can apply this filter when generating a report and when viewing a completed report. For example, you might want a delta report to include all differences compared to the base report but print the delta report with the added data only.
NOTE:
Filters apply at the data level only. The delta comparison function cannot compare changes made to a check, such as modifications to attribute criteria. To determine if a check has been modified, review the Audit History log.
Some operating systems might interpret modifications as additions and deletions. For example, if you modify the user name ADMINISTRATOR to ADMIN, the system reports that ADMINISTRATOR was deleted and ADMIN was added. To ensure that similar changes are included in the delta report, you might want to enable the Added and Deleted options.
The report displays a message when data results do not match the chosen filters.
To filter a delta report:
(Conditional) To generate a new delta report, complete the following steps:
Follow the instructions in the Delta Comparison wizard.
In the Report Options window, click the Layout tab.
Specify the filters you want to apply to the data.
Click Finish.
Follow the remaining instructions in the wizard.
(Conditional) To view a delta report, complete the following steps:
Click the Full Report tab.
Click Full Report Options.
On the Report Options window, click the Layout tab.
Specify the filters you want to apply to the data.
Click Finish.
(Optional) To distribute the filtered delta report to a folder, file share, or email recipient, see Section 5.3.5, Distributing Delta Reports to a File Share or Folder and Section 5.3.6, Distributing Delta Reports to an Email Recipient.
You can schedule a delta report to run each time a scheduled policy template runs for the same endpoint. This method provides two reports at runtime: the report containing results for the policy template run and the delta report.
NOTE:To distribute a report, you must install the Secure Configuration Manager console on the same drive where you installed Core Services.
To schedule a delta report with a policy template:
Ensure that at least one run of the policy template is complete. For more information, see Section 5.3.2, Comparing Policy Template Results.
In the left pane, click IT Assets.
In the IT Assets tree pane, expand Managed Groups and select the same managed group or individual endpoints that the previous run of the policy template ran against.
Right-click the group or endpoints, then click Run Policy Template.
Follow the instructions in the wizard, ensuring you select the same policy template.
In the Schedule window, specify how often you want the report to run on a recurring basis.
In the Delta Reporting window, select Enable Delta Reporting.
Click Setup.
Follow the instructions in the Delta Comparison wizard, and then follow the remaining instructions in the Run Policy Template wizard.
When distributing a scheduled delta report, you can choose to overwrite the existing report so only the latest copy of the report is in the folder or share. Your Core Services account needs the Full Control permissions to the file share where you want to save the report. By default, Core Services runs under the LocalSystem account. For more information, see Section 3.6, Managing Permissions.
NOTE:
To distribute a report, you must install the Secure Configuration Manager console on the same drive where you installed Core Services.
To distribute a delta report, at least one run of the policy template must be complete.
To distribute a report in Excel format, Microsoft Excel must be installed on the Core Services computer. For more information, see the NetIQ Secure Configuration Manager Installation Guide.
When you distribute a report in .xml format, Secure Configuration Manager does not apply filters that were applied to the viewed report. For more information, see Section 5.3.3, Filtering a Delta Report.
To distribute a delta report to a file share or folder:
Ensure that at least one run of the policy template is complete. For more information, see Section 5.3.2, Comparing Policy Template Results.
In the left pane, click IT Assets.
In the IT Assets tree pane, expand Managed Groups and select the same managed group or individual endpoints that the previous run of the policy template ran against.
Right-click the group or endpoints, then click Run Policy Template.
Follow the instructions in the wizard, ensuring you select the same policy template.
In the Delta Reporting window, select Enable Delta Reporting.
Click Setup.
Follow the instructions in the Delta Comparison wizard.
In the Distribution window, select Enable Distribution.
Click Add, and select File distribution.
In the File Distribution window, complete the required fields.
(Optional) To overwrite an existing file, select Overwrite existing file.
(Optional) To create a new file for each report run, select Save all runs of the report.
(Optional) To compress the report, select Compress this file before distributing and then specify the file extension for the compressed file.
Click OK.
Click Finish.
Follow the remaining instructions in the Run Policy Template wizard.
To distribute delta report results to specified users through email, ensure that you have specified a mail server for Secure Configuration Manager to use to send email. You can specify a mail server using the Core Services Configuration Utility.
NOTE:
To distribute a report, you must install the Secure Configuration Manager console on the same drive where you installed Core Services.
To distribute a delta report, at least one run of the policy template must be complete.
To distribute a report in Excel format, Microsoft Excel must be installed on the Core Services computer. For more information, see the NetIQ Secure Configuration Manager Installation Guide.
When you distribute a report in .xml format, Secure Configuration Manager does not apply filters that were applied to the viewed report. For more information, see Section 5.3.3, Filtering a Delta Report.
To distribute delta report results through email:
Ensure that at least one run of the policy template is complete. For more information, see Section 5.3.2, Comparing Policy Template Results.
In the left pane, click IT Assets.
In the IT Assets tree pane, expand Managed Groups and select the same managed group or individual endpoints that the previous run of the policy template ran against.
Right-click the group or endpoints, then click Run Policy Template.
Follow the instructions in the wizard, ensuring you select the same policy template.
In the Delta Reporting window, select Enable Delta Reporting.
Click Setup.
Follow the instructions in the Delta Comparison wizard.
In the Distribution window, select Enable Distribution.
Click Add, and select Email distribution.
In the Email Distribution window, complete the required fields.
(Optional) To compress the report, select Compress this file before distributing and then specify the file extension for the compressed file.
Click OK.
Click Finish.
Follow the remaining instructions in the Run Policy Template wizard.
Once you have run a delta report, you can export the full report for detailed viewing or simply export the data from the tables for a simplified view.
You can export the full delta comparison report, including the cover page, for detailed viewing later or to share with others.
NOTE:
To export a report in Excel format, Microsoft Excel must be installed on the Core Services computer. For more information, see the NetIQ Secure Configuration Manager Installation Guide.
When you export a report in .xml format, Secure Configuration Manager does not apply filters that were applied to the viewed report. For more information, see Section 5.3.3, Filtering a Delta Report.
To export delta comparison report data:
Open the delta comparison report you want to export.
Right-click the report, then click Export Full Report.
Type the file name and select one of the following file formats:
.tsv (tab-separated values)
.rtf (rich-text format)
.xml
.xls or .xlsx (depending on the Excel version that you use)
Click Save.
You can export the table data from the delta comparison report for a simplified view.
NOTE:When you distribute a report in .xml format, Secure Configuration Manager does not apply filters that were applied to the viewed report. For more information, see Section 5.3.3, Filtering a Delta Report.
To export delta comparison report data:
Open the delta comparison report you want to export.
Right-click the report, then click Export Data View.
Type the file name and select one of the following file formats:
.xml
.html
.txt (tab-delimited text file)
.xls or .xlsx (depending on the Excel version that you use)
Click Save.