Compliance statuses
Describes the status values used at each level of a compliance scan.
A compliance scan reports status at several levels: the scan itself, each benchmark it runs, and each rule within a benchmark. The wording differs slightly at each level.
Not every value applies in every product. Arc has no scheduling, so it never shows a Schedule status or the Scheduled trigger value.
| Level | Values |
|---|---|
| Scan status | Queued, Running, Cancelling. Once the scan completes: Cancelled, Compliant, Non-compliant, Not applicable, Not run, Error, Unknown |
| Status reason | For a scan or benchmark status, a more specific reason can replace the general status when known: Target not found, Not delivered, Failed, Timed out, Cancelled, Target unsupported, Target metadata missing, No eligible benchmarks, All benchmarks not applicable, Unreadable result, Platform mismatch, Benchmark metadata missing, Benchmark unavailable, No result returned, No rules applied. The Scan logs status filter offers the specific labels a row can display. A scan always shows its specific reason when it has one, so Error and Not run never appear as bare labels. |
| Benchmark status | Uses the same values as Scan status |
| Rule result | Pass, Fail, Error, Unknown, Not applicable, Not checked, Not selected, Informational |
| Severity | Critical, High, Medium, Low, Unknown |
| Schedule status | Draft, Active, Paused |
| Trigger | Manual, Scheduled |
A rule's severity is set by the author of the benchmark file, for example DISA for a Security Technical Implementation Guide (STIG) benchmark. It cannot be changed by Nozomi Networks or by you.
Results aggregation
When a scan includes more than one benchmark, Nozomi Networks combines the individual benchmark results into a single overall verdict for the scan:
- If any benchmark is Non-compliant, the scan is Non-compliant.
- Otherwise, if at least one benchmark is Compliant, the scan is Compliant. A benchmark that returns Not applicable, for example because the target does not have the software the benchmark checks, does not prevent this.
- If every benchmark in the scan returns Not applicable, the scan is Not applicable.
For example, a scan runs three benchmarks: one for Linux, one for Google Chrome, and one for Adobe Reader. Chrome is not installed on the target, so that benchmark returns Not applicable, while the other two return Compliant. The scan is still Compliant, because a benchmark that could not run does not count against the result.