Compliance

Help ID: shell.panel.compliance

The Compliance page is where you define which audit or benchmark each server gets measured against. It's the setup surface — the results of running those audits show up on the Reports tab.

[Image omitted: Compliance page with a profile selected]

What it does

An audit profile is just a named bundle of checks. You pick which checks belong to the profile, tune their pass/fail behavior on a per-server or per-database basis, restrict the scope to the servers and databases you actually care about, and then run it. Results land in HealthCheck.ReportLog plus per-metric HealthCheck.MetricLog* tables so you can review, compare, and export them from the Reports tab.

Reports are entirely offline analytics over already-collected data — they never phone home to a target server. Whoever hits Run now pays a few seconds of set-based SQL against the repository DB.

Topic Doc
Manage profiles (new / clone / delete, canned vs custom) Compliance profiles
The metric library and per-profile metric picker Compliance metrics
Threshold rules and the four-tier override cascade Compliance thresholds
Choosing which servers and DBs the run touches Compliance scope
Running a profile and reading the results Compliance run & history
Step-by-step recipes Compliance how-to recipes
Backend tables, SPs, and data flow Compliance backend reference

Layout at a glance

flowchart LR
    subgraph "Left rail"
        A["Profiles list<br/>CIS Audit / MVA / custom"]
    end
    subgraph "Right pane"
        B["Overview<br/>Name, description,<br/>benchmark source"]
        C["Metrics<br/>In-profile + library"]
        D["Thresholds<br/>Per-scope rules"]
        E["Scope<br/>SLA / servers / DBs"]
        F["Run & History<br/>Execute + results"]
    end
    A --> B
    A --> C
    A --> D
    A --> E
    A --> F

The left rail is your profile picker; the right pane is a five-tab editor for the profile you picked.

Concepts

Three primitives compose everything on this page. All three live in the HealthCheck schema on the repository DB.

  • Profile — one row of HealthCheck.Report. Just a named container: "CIS Audit", "Microsoft Vulnerability Assessment", or any custom name. Details: Compliance profiles.
  • Metric — one row of HealthCheck.Metric, backed by one stored procedure. About 90 shipped metrics cover Minion originals (MetricSysadminCount, MetricTrustworthy, …) and Microsoft Vulnerability Assessment rules (VA1020, VA1043, …). Details: Compliance metrics.
  • Threshold — one row of HealthCheck.MetricThreshold. Tunes pass/fail for a metric on specific servers/DBs. Details: Compliance thresholds.

The link between them is the junction table HealthCheck.ReportMetric (which metrics belong to which profile). When you hit Run, HealthCheck.ReportMaster walks that link, resolves cascading thresholds, and executes each metric SP against the already-collected Collector.* data.

Symbol legend

Every colored chip, pill, badge, and indicator you'll see on the Compliance page:

Symbol Where Meaning
AUDIT badge (blue) Left rail profile row Canned benchmark with HealthCheck.AuditDictionary metadata (CIS, MVA, etc.)
CUSTOM badge (gray) Left rail profile row User-authored profile
N overrides chip (blue) Metrics tab, per row That metric has N threshold rules on the Thresholds tab
Default pill (gray) Thresholds grid, Scope col Rule applies to every server and every DB — the fallback
Instance pill (blue) Thresholds grid, Scope col Rule applies to every DB on one specific server
Database pill (amber) Thresholds grid, Scope col Rule applies to one DB name across every server
Server + DB pill (green) Thresholds grid, Scope col Rule applies to exactly one (server, DB) pair — most specific, wins
Active / Off button Metrics tab, per row Toggle the metric's IsActive flag without unlinking it
system chip (gray) Scope tab, DB list System DB (master, model, msdb, tempdb, distribution, ReportServer*, SSISDB) — starts unchecked
Fail pill (red > 0, gray = 0) Run & History grid Row count that failed the metric in that run
Pass pill (green > 0, gray = 0) Run & History grid Row count that passed the metric in that run
Red horizontal line All grouped grids Separator between groups when a column has been dragged into the group panel
Yellow / green tab dot Panel tab caption Yellow = still loading; green = fresh data since you last activated the tab

Related: Reports, MinionGrid, Shell.