A question regarding security compliance on Puppet Enterprise Advanced. This SCM product/feature is not included by default i take it? But if we buy such a license, is access to CVE compliance data built in, or do we need to buy a separate CVE scanner service to actually be able to use it?

@Jason St-Cyr do we have anyone who could help on this. @Goran Brannstrom in the mean time try asking your question to the AI tooling on help.puppet.com it is usually pretty good for these sorts of arch questions

I feel like SCM and SCE might be getting mixed up here... From what I know, SCM module is now included in your Puppet Enterprise license. I don't know if that's always been the case, but what I've read recently is that your Puppet Enterprise license allows you to download and install the SCM module. So from what I understand the SCM module itself is included by default in your license, but you might need to install it? SCE (Security Compliance Enforcement) is the part that does the continuous enforcement of this and is not included in a Puppet Enterprise license. That one is included in Puppet Enterprise Advanced, or can be purchased as an add-on. SCM does need a scanner. You can hook in your own scanner, or use the CIS-CAT PRO Assessor that is bundled in. There are configurations you have to enable to make it work, though. I want to caveat that this is what I know from reading the docs and chatting with people, but SCM/SCE is not really my area of expertise. To double-check my work, I'll tag in @Saurabh Karwa !

@Goran Brannstrom, Jason is right, (almost 😛) So, as a Puppet Enterprise customer, you can download and use the SCM product. It is included with your Puppet Enterprise subscription. SCM is the capability that allows continuous visibility of the CIS compliance for your nodes. You get the CIS scanner along with the product - which checks the compliance of your nodes. SCM does not allow you to plug in your custom CIS benchmark scanner (you don't need to, actually) Puppet Enterprise Advanced subscription includes access to SCE (along with SCM of course). This ensures visibility provided by SCM while elevating your security hardening by allowing you to continuously enforce desired state in compliance with CIS Puppet Enterprise Advanced subscription also includes the Advanced Patching capability, which easily integrates with Tenable Nessus and by configuration, with other security scanners to give you the vulnerability data that you use Advanced Patching to then fix. Security scanners are not included with Puppet Enterprise Advanced Please let me know if this helps or if there are more questions CC: @Jason St-Cyr

Thank you Saurabh! I got my advanced patching and SCE mixed up 😄

Ok, so where do i download SCM from? Puppet forge?

This link contains all the details, below is a high-level summary of the basic steps, but recommend to go through the documentation 1. Install Bolt 2. Use Bolt to install puppetlabs-complyadm from the Forge 3. Configure the SCM install 4. Add puppetlabs-comply module to the Puppetfile & deploy 5. Classify nodes in PE

Thanks! So enabling this does not incur any extra license fees beyond what we already pay for PE Advanced? And we can stop manually googling all the hundred CVE's we get mailed to us from IT Security department every day?

If you already are paying for PEA, then this shouldn't have any extra cost to you. You should also look into pairing SCE with your SCM: Installing SCE | Security Compliance Enforcement | V2 You should be entitled to that as well.

Thanks for explaining! We will definitely try this. 🙂

The command syntax looks good, but I'm just wondering if the auth is failing? Might also be good to break this out into another thread as most folks won't see this error and you'll just be getting guidance from product folks here 😄

Puppet cleaned away the repo before i could use it. And then i had to do "dpkg --purge" and do it all again. So i got a bit further. Now i'm stuck doing "`bolt module install` because apparently i cant use the licens id as the API token to download "complyadm" It's not supposed to be easy i guess.. I submitted this to your support. I hope they can help me out...

Strange... I thought you could normally auth for download with the license ID so that it checks your entitlements using that. I was sure I'd done that in the past with the EdgeOps module, but maybe I actually set up a Forge API key on my organization that had access and downloaded with that.

Well, that would have made my easier. But no, there's a separate forge api for premium models, apparently: https://forge.puppet.com/about/premium?utm_medium=in-app&utm_source=puppet&utm_campaign=pup-glb-2024-products-impact-analysis The thing is the docs on how to install SCM give very scant guidance on which kind of user one is supposed to do the installation as. A personal account, root account, a new account created as as systems account for SCM? I have to guess the whole time. Any guidance on this? What is the easiest route?

That might be a good question for the #C03LDTDUYAV channel? Unless @Saurabh Karwa has thoughts on this.

@Goran Brannstrom in terms of Forge download, create a Forge token (ideally a long lived one) after logging into your Forge account -> View Profile -> API Keys -> Create a key and use that installing the complyadm module

Question: Can i use SCM to check against current CVE's, which is the main purpose i installed it?

SCM provides a status of your compliance posture against CIS benchmarks. So it would compare your OS configurations against industry best practices and highlight which rules are failing If you are looking at a Vulnerability Remediation solution, that would be Advanced Patching in the Puppet Portfolio, it integrates with a scanner of your choice (Tenable Nessus Out of the Box) and allows you to manage the patching against those vulnerabilities using the Puppet setup Let me get in touch with the sales representative for your account and we can do a quick session to understand your priority areas and propose a solution accordingly - in my opinion, that would be the quickest way to set you up for success

Thanks for your input! That is one way forward.