Profiles
Overview
Compliance profiles help you secure your infrastructure continuously. Chef Automate compliance profiles translate CIS Benchmarks and other security standards into easily readable policy. You can install and download one of our 300+ ready-to-use compliance profiles from Profiles, or upload your custom profiles.
Using Profiles
Navigate to compliance profiles by selecting the Compliance tab and then selecting the Profiles page, or by heading to https://automate.example.com/compliance/compliance-profiles
.
Profiles has a search bar and two views: the Profiles page, which displays the profiles you’ve installed in your unique namespace within Chef Automate, and the Available page, which displays all of the ready-to-use compliance profiles in Chef Automate.
Installing Profiles
Locate profiles by browsing the list, or by using the search bar. To install a compliance profile into your namespace, simply select Get on the right side of the profile name.
Download compliance profiles to your workstation for use with Scan Jobs and the Audit Cookbook, or as a basis for your own customizations. Start by selecting the arrow on the far right side of the profile, which redirects you to the Profile Details view. Select the download button on the upper right corner of the profile description and download your selected profile as a tarball compressed with gzip (’.tar.gz’).
Uploading profiles
Upload Any InSpec2 compatible profile–including inherited profiles–to Chef Automate with the upload button on the Profiles page.
Uploads use either the .tar.gz
or zip archive file formats.
All profiles are stored in PostgreSQL, and are covered by backup and restore functionality.
Note
inspec.yml
. Older builds of Chef Automate require at least three elements of the x.y.z form – for example, “1.2.0” – and optionally can have one additional element, such as “1.2.0-20”. Newer Chef Automate builds allow both two-element and three-element profile versions.Updating profiles
New releases of profiles are shipped with the product when available. Chef ships only the latest versions of profiles. When Chef publishes a newer profile version that a user has installed to their namespace, a small notification appears, prompting the user to download the newest version. Installing the newest version adds the updated profile to the user namespace, but it does not overwrite an existing profile. You can keep multiple versions of a profile and it is up to you to curate your installed profiles.
Understanding Profiles
The Profile Details page appearance varies, depending on if a profile is installed or not. You can Get or Download uninstalled profiles from the details page of an uninstalled profile. You can Download or Delete a profile from the page of an installed profile. Deleting a profile removes it from the profiles collection in your namespace, but it remains available in Profiles. Installed or uninstalled, a profile’s header and body contains important information.
Profile Header
The profile header displays the profile title, a brief description and Get and Delete buttons. If you have installed the profile, and Get or Download button if the profile is available but not installed in your unique namespace. In either case, the profile header displays a status box detailing the:
- Status
- Installed or uninstalled
- Version
- The version number of the profile, which changes with updates
- Author
- The organization responsible for composing and updating the profile
- License
- Restrictions on the profile’s re-use.
Installed profiles display a cURL command for an ad-hoc profile run.
Profile Body
A profile is made up of a series of controls, which are listed in the Profile Detail’s body. Each control has one or more InSpec tests. The control table shows the number and names of controls in the profile, as well as the:
- Total tests
- the number of tests in the control
- Severity
- The impact of a control, from 0 to 1. See the Chef InSpec documentation for more information about the severity measure
Selecting the shaded area next to the control name or the +
on the right side expands the control to show a more detailed description.
Selecting View Code displays the control’s InSpec code.
About the Profile Identifier
The profile identifier is composed of the user’s username and the profile name, found in the installed profiles list at https://automate.example.com/profiles
.
Use this identifier when specifying profiles for the audit cookbook as well as specifying profiles through the InSpec CLI.
Note
Interacting with Chef Automate Profiles
You can interact with Chef Automate Profiles from the command line, as well as from the user interface. For more information, see the InSpec CLI subcommand.
API Calls
We’ve provided you with some essential cURL commands for interacting with Chef Automate Profiles. In these examples, the owner is same value as first part of identifier, as discussed in About the Profile Identifier.
Get All Installed Profiles
curl --insecure -H "X-Data-Collector-Token: token-value" https://automate.example.com/api/v0/compliance/profiles/search -d '{"owner": "test"}'
Get All Available Profiles
curl --insecure -H "X-Data-Collector-Token: token-value" https://automate.example.com/api/v0/compliance/profiles/search -d '{}'
Download .tar
curl --insecure -H "x-data-collector-token: token-val" https://automate.example.com/api/v0/compliance/profiles/tar -d '{"name":"cis-aix-5.3-6.1-level1","owner":"admin","version":"1.1.0-3"}'
Upload tar
curl --insecure -F file=@cis-ubuntu12_04lts-level1-1.1.0-2.tar.gz -H "x-data-collector-token: token-val" https://automate.example.com/api/v0/compliance/profiles?owner=admin