Creating Enforcement Sets

The Enforcement Center allows you to actively control your asset environment. Use it to build and apply policies and create triage and remediation actions. Enforcements may be automated or run manually. The following procedure describes how to create a new Enforcement Set using the Create Enforcement Set button.

To create an Enforcement Set

1. In the Enforcement Sets page, click Create Enforcement Set. The Create Enforcement Set drawer opens.

   The Create Enforcement Set drawer displays all available Enforcement Actions according to their category. The most recently used Actions are in the Recently Used category. Click the arrows on the right of a category to expand or collapse the category.

   You can display Enforcement Actions in two views:

   • Click the List icon to display the Enforcement Actions in a list view.

     

   • Click the Tiles icon to display the Enforcement Actions in a tile view.

     

2. In the Create Enforcement Set drawer, select an Enforcement Action in one of the following ways:

   • Recently used Actions appear at the top.
   • Scroll the list of Actions and click the Action you want.
   • In the Search action field, begin typing the name of the Action you want. The list is automatically filtered as you type.
   • From the Category list, select one or more categories and then an Action.

   The selected Action is added to the Enforcement Set as the Main Action.

3. In the Enforcement Set name field, use the default name provided or enter a different name for the Enforcement Set.

   Note:

   Axonius autofills fields with default values where possible. Required fields are marked with a * next to the field name.

4. To add a description to the Enforcement Set, click Add description and type a description in the Description text box.

5. In the Run action on assets matching following query field, from the Module list, select the module/asset type you want to query. Then, from the Select Query list, do one of the following:

   • Select a saved query from the list.

   

   • Click + Add Query to create a new query using the query wizard. To learn more about creating a new query, see Creating a New Query.

6. In the Main Action section, use the default name provided in Action name or enter a new name.

7. If you want to configure dynamic values for this action, toggle on Configure Dynamic Values and Define the statement with the assistance of the Dynamic Value Statement Wizard (the default) or the Syntax Helper with Autocomplete feature. To learn more about statement syntax, see Creating Enforcement Action Dynamic Value Statements.

9. Fill in the remaining required fields for the Main Action. These are the fields in the Required Fields tab. To learn more about each Enforcement Action and its fields, see the Enforcement Action Index.

10. Once all required fields are filled in, you can test the connection to the Adapter by clicking Test Connection. This functionality is not available for all Enforcement Actions.

11. To configure optional fields, open the Additional Fields tab, and provide values for the fields you want to use. See the Enforcement Action Index for details on each field of each Enforcement Action.

12. To configure scheduling and run the Enforcement Set automatically at specified times, toggle on Set scheduling and set the schedule parameters. See Scheduling Enforcement Set Runs.
13. To configure Success Actions, Failure Actions, or Post Actions, click Advanced Options. See Configuring Success, Failure and Post Enforcment Actions below.
14. Do one of the following:
    • To save the Enforcement Set at any time, even if not all required fields are filled in, click Save. The Drafts folder on the Enforcement Set page is displayed.
    • To test the outcome of the Actions, click Test Run. See Testing an Enforcement Set for more information on using Test Run.
    • To save the Enforcement Set and run it, click Save and Run. You can view the results of all Enforcement Set runs on the Run History page. See Viewing Run History.

Configuring Success, Failure, and Post Enforcement Actions

An Enforcement Set can include one or more Success, Failure, and/or Post Actions.

• Success Actions are run on each asset for which the Main Action completes successfully.
• Failure Actions are run on each asset for which the Main Action does not complete successfully.
• Post Actions are run on ALL assets matching the query after the Main action has completed.

As actions are added, they are organized under the Main Action as shown below:

To configure Success, Failure, and Post Enforcement Actions

1. At the bottom of the Create Enforcement Set drawer, click Advanced options. A two-pane Enforcement Set drawer opens with Overview in the left pane and a description of the selected item in the right pane.

2. To add an Action, hover the mouse pointer over button under Main Action. The types of actions you can add are displayed.

3. Click one of the Actions and select the Action you want from the drawer. A tile for the Action is added under the Main Action and is automatically selected. Action details are displayed in the right pane. Configure all required fields and whatever optional fields you want.

4. To add more Actions:

5. By default, the Main Action is run first, then all other Actions are run concurrently.

   • To require all actions in the Enforcement Set to run serially in the order they are configured, at the top of the Overview pane, click the gear icon and toggle on Apply action execution order.

   

   When this option is enabled, all Success Actions are run according to their configured order. Then, all Failure Actions are run according to their configured order. Lastly, all Post Actions are run according to their configured order.

   Note:

   Enabling this option affects the time it takes the Enforcement Set to run. Running Actions concurrently generally takes less time than running them in order.

6. By default, all actions following the Main Action run as soon as they appear in the ready to execute queue. To delay the execution of a Success, Failure, or Post Enforcement Action, click the Immediate button on the Action pane, and configure the delay of the action. Learn more on how to configure the action delay.

7. When you have added and configured all the Actions you want, do one of the following:

   • To save the Enforcement Set and continue editing, click Save. The Enforcement Set is saved.
   • To test the outcome of the Actions, click Test Run. See Testing an Enforcement Set for more information on using Test Run.
   • To save the Enforcement Set and run it, click Save and Run. The Enforcement Center page is displayed with the My Enforcements folder selected. You can view the results of all Enforcement Set runs on the Run History page. See Viewing Run History.

Delaying Enforcement Action Execution

You can configure a Post, Success, or Failure action to execute immediately when its turn arrives in the ready to execute queue (the default), or delay its execution by a defined amount of time.

Example
You want to send an email reminder to customers to let them know that their software license is expiring and will be revoked in a month. You want to automate the actual revoking of the license to occur one month later in order to give the customers time to investigate similar software options or renew the license. In this case, the Main Action is Axonius - Send Email and the Post Action is revoking permissions to the software license. You delay this Post Action by one month.

To delay enforcement action execution

1. In the top right of the Enforcement Action (Post, Success, or Failure) configuration pane, click the Immediate button. A dialog opens for selecting Immediate (the default) or Delay.

1. Select Delay, and then define the length of the delay:
   • From the second dropdown, select the unit of time: Seconds, Minutes, Hours, or Days.
   • From the first dropdown, select the number of units.

The button shows the configured delay. For example, Delayed by 5 minutes.

Creating a New Query