Automate Run a Compliance Scan and Retrieve Reports
A 4-step recipe with Chef. We can help you get access.
Recipe · 4 steps
Automate Run a Compliance Scan and Retrieve Reports
with Chef
Launch an InSpec scan job in Chef Automate and collect its report.
- List the InSpec compliance profiles installed in Automate so the scan job references a profile the server can actually resolve.
- List the nodes Automate is managing so the scan targets real, reporting infrastructure rather than an unmanaged host.
- Create the compliance scan job pairing the chosen profiles with the chosen nodes. Automate queues the job and executes it asynchronously.
- Search the compliance reporting index for the report produced by the scan. Because the job runs asynchronously, this step is the collection point and may be repeated until the report for the job appears.
What you'll need to have ready
- jobName: A name for the scan job (e.g. "nightly-cis-baseline").
- profiles: The InSpec profile identifiers to run, as resolved from the profiles list.
- nodes: The node identifiers to scan, as resolved from the managed nodes list.
- reportFilters: Reporting filters narrowing the search to this run (e.g. by job_id or date).
- perPage: How many reports to return per page from the reporting search.
For your developer
Arazzo workflow chef:run-compliance-scan, 4 operations: listComplianceProfiles → listManagedNodes → createScanJob → searchReports. Specs on APIs.io.