Compliance profiles

Help IDs: compliance.profile.new, compliance.profile.clone, compliance.profile.delete, compliance.tab.overview, compliance.overview.comment, compliance.overview.isaudit, compliance.overview.save

Everything on the Compliance page hangs off a profile. This page covers what a profile is, how the left rail presents them, and how to create, clone, edit, and delete them.

[Image omitted: Left rail with the four canned profiles]

What is a profile

One row of HealthCheck.Report. It has three fields:

Everything else about "what the profile does" is expressed by: - Which metrics are linked to it in HealthCheck.ReportMetric — see Compliance metrics. - Which threshold rules override its defaults in HealthCheck.MetricThreshold — see Compliance thresholds.

If the profile represents a published benchmark, HealthCheck.AuditDictionary carries the provenance (benchmark name, target SQL version, description, reference URL).

Shipped profiles

Out of the box, Minion Enterprise ships with these:

You should almost never edit the shipped audit profiles directly — clone them into a new name (e.g. Acme Prod CIS) and tune the clone. That preserves the pristine benchmarks for reference and future updates.

Left rail

[Image omitted: Anatomy of a profile row]

Each row shows:

• Profile name — from HealthCheck.Report.ReportName.
• AUDIT / CUSTOM badge — driven by IsAudit.
• Active metric count / total metric count — derived from ReportMetric. Format: 27 active / 30 metrics.
• Last run — most-recent ReportExecutionDateTime in HealthCheck.ReportLog for this profile, or never run.

Clicking a row loads all five tabs for that profile.

Buttons

Three buttons sit above the list.

+ New

Creates a blank profile named New profile (or New profile 2, 3, … if a collision would happen). The profile starts with no metrics and no thresholds. You then:

1. Rename via the Overview tab if you want a real name (see below).
2. Add metrics on the Metrics tab.
3. Optionally add threshold rules on the Thresholds tab.
4. Choose scope on the Scope tab.
5. Run on the Run & History tab.

Clone

Duplicates the selected profile into a new name (<Original> (copy), with the same numeric-suffix collision logic as + New). Runs the SP HealthCheck.CloneReport, which copies over:

• The Report row itself with the new name.
• Every ReportMetric link so the clone starts with the same metric set.

Threshold rules are NOT copied. The clone starts with only the defaults that came with each metric's SP; add per-server tuning on the Thresholds tab as needed.

Delete

Removes the selected profile. All associated rows in HealthCheck.ReportMetric and HealthCheck.MetricThreshold for that profile are deleted too. ReportLog history is preserved — past runs remain visible if you later recreate a profile with the same name.

There's no undo. Clone first if you're unsure.

Overview tab

[Image omitted: Overview tab for the selected profile]

Two editable fields:

• Description — free-text Comment. Multi-line, wraps. Explain what this profile is for so future-you (or the next DBA) knows why it exists.
• This profile represents an external audit / benchmark — sets the IsAudit flag, which drives the AUDIT/CUSTOM badge on the left rail.

Editing these fields does not save immediately (unlike the Metrics, Thresholds, and Scope tabs). Click Save changes when you're done.

Benchmark source card

When the profile name matches a row in HealthCheck.AuditDictionary, an extra card appears above the Description showing:

• Benchmark name — e.g. CIS Microsoft SQL Server 2014 Benchmark.
• Target SQL version — the SQL Server major version the benchmark targets.
• Description — the auditor-facing summary.
• Reference URL — link to the published benchmark spec.

Custom profiles don't have this card because they aren't in AuditDictionary. If you want the card to appear on a cloned profile, insert a row into AuditDictionary matching your new ReportName — the UI picks it up next refresh.

Example configurations

Example 1 — Acme Prod CIS (locked-down clone)

• Cloned from CIS Audit and renamed.
• IsAudit ON (retained from source).
• Description: CIS baseline for Acme production tier. Exceptions on Prod-DB-01 and legacy Bronze servers are in Thresholds.
• Metrics: full CIS set retained.
• Thresholds: a handful of per-server allowances (see Thresholds recipes).
• Scope: SLA = Gold, all servers checked.

Example 2 — Weekly security spot-check (custom)

• Blank profile named Weekly security spot-check.
• IsAudit OFF.
• Description: Runs every Sunday. Just the checks that materially indicate someone touched security.
• Metrics: a short list — Disable the sa Login Account, Sysadmin Count, Server Authentication, CLR Enabled, xp_cmdshell, Ole Automation Procedures.
• Thresholds: single default rule per metric (no per-server overrides).
• Scope: SLA = (All), Include list narrowed to specific hosts.

Example 3 — Dev-only permissive (custom)

• Blank profile named Dev permissive.
• IsAudit OFF.
• Description: Loose thresholds — dev servers have known-bad settings on purpose. Just watch for regressions in what SHOULD be right.
• Metrics: pared down to fundamentals — SP file layout, Trustworthy, Guest-account controls.
• Thresholds: Violation = false on most rules to invert pass/fail; higher sysadmin count limits.
• Scope: SLA = Bronze.

Common gotchas

• Deleting doesn't clear ReportLog. Historical results survive. If you re-create a profile with the same name, its history reappears — same rows, same timestamps.
• Renaming a profile is not supported in the UI yet. Clone into the new name and delete the old one if you must rename.
• The Save button only saves the Overview tab. Metrics, Thresholds, and Scope edits write immediately. Don't wait for Save to commit a metric add.

Related: Compliance overview, Compliance metrics, Compliance thresholds, How-to recipes.