Chapter 2. Getting started using the compliance service This section describes how to configure your RHEL systems to report compliance data to the Insights for RHEL application. This installs necessary additional components such as the SCAP Security Guide (SSG), which is used to perform the compliance scan. Prerequisites The Insights client is deployed on the system. You must have root privileges on the system. Procedure Check the version of RHEL on the system: Review the Insights Compliance - Supported configurations article and make note of the supported SSG version for the RHEL minor version on the system. Note Some minor versions of RHEL support more than one version of SSG. The Insights compliance service will always show results for the latest supported version. Check if the supported version of the SSG package is installed on the system: Example - for RHEL 8.4 run: If it is not already installed, install the supported version of SSG on the system. Example - for RHEL 8.4 run: Assign systems to policies using the Insights compliance service UI, or using insights-client commands in the CLI: Use the compliance service UI to navigate to Security > Compliance > SCAP policies and use one of the following methods to add systems: Creating new SCAP policies Editing included systems You can also add systems by using the following insights-client commands on the CLI: insights-client --compliance-policies to list available policies and their associated ID insights-client --compliance-assign <ID> For more information about using insights-client commands to add systems, see Managing SCAP security policies in the Insights for RHEL compliance service in Assessing and Monitoring Security Policy Compliance of RHEL Systems with FedRAMP . Options for the Insights client in Client Configuration Guide for Red Hat Insights with FedRAMP . After adding each system to the needed security policy, return to the system and run the compliance scan using: Note The scan can take 1-5 minutes to complete. Navigate to Security > Compliance > Reports to view results. Optional: Schedule the compliance jobs to run with cron . Additional Resources To learn which versions of the SCAP Security Guide are supported for Red Hat Enterprise Linux minor versions, see Insights Compliance - Supported configurations . 2.1. Setting up recurring scans for Insights services To get the most accurate recommendations from Red Hat Insights services such as compliance and malware detection, you might need to manually scan and upload data collection reports to the services on a regular schedule. Use the following insights-client commands to run the commands manually: Currently, Insights does not have an automated scheduler to perform the scans for you, but you can configure a cron job to schedule automatic scans. Important Before you create a cron job, make sure that the commands work properly when you run them manually. Prerequisites The services you want to use (Compliance and Malware Detection) are configured and running on your system. Procedure At the system prompt, issue the crontab -e command to edit the crontab file. This command opens your default text editor. Add a crontab entry for the service you want to run. For example: In this example, the first command uploads a Compliance report to Insights every day at 20:10 local time. The second command uploads a malware detection report to Insights every day at 21:10 local time. Save the file and exit the text editor.

Commands:
[user@insights]USD cat /etc/redhat-release
dnf info scap-security-guide-0.1.57-3.el8_4
dnf install scap-security-guide-0.1.57-3.el8_4
insights-client --compliance
insights-client --compliance insights-client --collector malware-detection
crontab -e
10 20 * * * /bin/insights-client --compliance 10 21 * * * /bin/insights-client --collector malware-detection