Creating Enforcement Sets
  • 11 Dec 2022
  • 6 Minutes to read
  • Dark
    Light
  • PDF

Creating Enforcement Sets

  • Dark
    Light
  • PDF

The Enforcement Center allows you to actively control your asset environment. Use it to build and apply policies and create triage and remediation actions. Enforcements may be automated or run manually. The following procedure describes how to create a new Enforcement Set.

To create an Enforcement Set

  1. Click image.png icon on the left navigation panel. The Enforcement Center page opens.

  2. Click Create Enforcement Set. The Create Enforcement Set drawer opens.

    ECCreateESetDrawer.png

  3. In the Enforcement Set drawer, select an Enforcement Action in one of the following ways:

    • Recently used Actions appear at the top of the unsorted list.
    • Scroll the list of Actions and click on the tile of the Action you want.
    • In the Search action field, begin typing the name of the Action you want. The list is automatically filtered as you type.
    • From the Category list, select one or more categories and then an Action.

    The selected Action is added to the Enforcement Set as the Main Action.

    ECCreateESetDrawer-AddedMainAction.png

  4. To add a description of the Enforcement Set, click Add description and type a description in the text box.

  5. In the Enforcement name field, use the default name provided or enter a different name for the Enforcement Set.

    NOTE
    Axonius auto-fills fields with default values where possible. Required fields are marked with a * next to the field name.
  6. In the Run action on assets matching the following query field, from the Module list, select the module/asset type you want to query. Then, from the Select Query list, do one of the following:

    • Select a saved query from the list.

    ECCreateESetDrawer-QuerySelection.png

    • Select Add Query to create a new query using the query wizard. See Adding a New Query below for more information about creating a new query.
  7. In the Main Action section, use the default name provided in Action Name or enter a new name.

  8. If you want to define conditions and dynamic values, toggle Configure Action Conditions and provide the condition definition. Click Validate to make sure the conditions are valid. See Configuring Enforcement Action Conditions for more information about condition syntax.

    ECCreateESetDrawer-ConfigActionCond.png

  9. Fill in the remaining required fields for the Main Action. For details about each Enforcement Action, see the Enforcement Action Index for details about each field.

  10. Once all required fields are filled in, you can test the connection to the Adapter by clicking Test Connection. This functionality is not available for all Enforcement Actions.

  11. Do one of the following:

  • To configure scheduling and run the Enforcement Set automatically at specified times, toggle Set scheduling and set the schedule parameters. See Scheduling Enforcement Set Runs.

  • To configure optional fields, click Additional Fields and provide values for the fields you want to use. See the Enforcement Action Index for details on each field of each Enforcement Action.

  • To have the Enforcement Set run at specific times, toggle Set Scheduling and fill in the details. See Scheduling Enforcement Set Runs.

  • To configure Success Actions, Failure Actions or Post Actions, click Advanced options. See Configuring Success, Failure and Post Enforcment Actions below.

  • To save the Enforcement Set at any time, even if not all required fields are filled in, click Save. The Drafts folder on the Enforcement Set page is displayed.

  • To use Test Run to test the outcome of the Actions, click Test Run. See Testing an Enforcement Set for more information on using Test Run.

  • To save the Enforcement Set and run it, click Save and Run. You can view the results of all Enforcement Set runs on the Run History page. See Viewing Run History.

Configuring Success, Failure and Post Enforcement Actions

An Enforcement Set can inlude one or more Success, Failure and/or Post Actions.

  • Success Actions are run on each asset for which the Main Action completes successfully.
  • Failure Actions are run on each asset for which the Main Action does not complete successfully.
  • Post Actions are run on ALL assets matching the query after the Main action has completed.

As actions are added, they are organized under the Main Action as shown below:

ECAddActionsAll.png

To Configure Success, Failure and Post Enforcement Actions

  1. At the bottom of the Create Enforcement Set drawer, click Advanced options. A two-pane Enforcement Set drawer opens with Overview in the left pane and a description of the selected item in the right pane.

EC-Set-Both-Panes.png

  1. To add an Action, hover the mouse pointer over Plus-button-sm.png button under the Main Action. The types of conditional actions you can add are displayed.

ECAddActionHover.png

  1. Click one of the Actions and select the Action you want from the drawer. A tile for the Action is added under the Main Action and is automatically selected. Action details are displayed in the right pane. Configure all required fields and whatever optional fields you want.

    ECMainAction-SuccessAction.png

  2. To add more Actions:

    ECAddActionPluses-3.png

  3. By default, the Main Action is run first, then all other Actions are run concurrently. To require all actions in the Enforcement Set to run serially in the order they are configured, at the top of the Overview pane, click the gear icon and toggle Apply action execution order to the on position.

    ApplyActionExecutionOrder.png

    When this option is enabled, all Success Actions are run according to their configured order. Then, all Failure Actions are run according to their configured order. Lastly, all Post Actions are run according to their configured order.

    NOTE
    Enabling this option will affect the time it takes the Enforcement Set to run. Running Actions concurrently will generally take less time than running them in order.
  4. When you have added and configured all the Actions you want, do one of the following:

    • To save the Enforcement Set and continue editing, click Save. The Enforcement Set is saved.
    • To use Test Run to test the outcome of the Actions, click Test Run. See Testing an Enforcement Set for more information on using Test Run.
    • To save the Enforcement Set and run it, click Save and Run. The Enforcement Center page is displayed with the My Enforcements folder selected. You can view the results of all Enforcement Set runs on the Run History page. See Viewing Run History.

Creating a New Query

You can create a new query instead of using an existing saved query. This new query will be saved in the folder selected and can be accessed from the Folders pane of the Queries page.

ECCreateESetDrawer-NewQuery

To create a new query

1. In Name, enter a name for the new query.

2. In Description, enter a description that includes what assets the query returns.

3. In Tags, add tags if necessary.

4. In Cache Settings, select whether to Always keep cached or deselect to not keep cached. When selected, query results are updated and stored in cache. This makes the Enforcement Set run faster.

5. In Query Expression, select the query parameters. For more about using the Query Wizard, see [Creating Queries with the Query Wizard](/docs/query-wizard-and-query-filter).

6. To make the query private and available only to you, select Private query.

7. In Folder, select the folder where the new query will be saved.

8. To save the query, click Save. Click Cancel to close the Query Wizard page without saving any changes.




Changing your password will log you out immediately. Use the new password to log back in.
First name must have atleast 2 characters. Numbers and special characters are not allowed.
Last name must have atleast 1 characters. Numbers and special characters are not allowed.
Enter a valid email
Enter a valid password
Your profile has been successfully updated.