23. Compliance: schedules and drift
This guide describes Lawliet 1.5.13.s (the current release). Screens, commands and procedures may change in later versions; the usage guide is updated with each release. Check the version your server runs under Settings > Platform or with ./lawliet version, and see the Releases page for what changed.
A schedule runs a compliance scan on a cadence, so the posture is measured without anyone remembering to do it. Drift is what changed between two scans of the same framework: a control that was passing and now fails, a new failure, an improvement.
Permissions:
| Task | Permission | Four-eyes |
|---|---|---|
| See schedules and drift | View compliance | - |
| Create, edit, enable, disable, delete, run a schedule now | Run scans | no |
| Compare two scans on demand | Run scans | no |
None of these actions change a host. Schedules start read-only scans; drift is a record.
23.1 The Schedules tab#
Path: Compliance > Schedules.
"The background scheduler checks every 60 seconds." A schedule that is due starts a scan at the next check. Drift detection runs shortly after each scheduled scan completes.
What you see:
- Tiles: Enabled, Due soon, Overdue, With errors.
- Table: Name, Framework, Scope, Recurrence, Status, Next run, Last run, Last scan, Actions.
- Actions per row: Run now (play), Enable / Disable (toggle), Edit (pencil), Delete (bin; asks Yes to confirm).
- View drift at the bottom opens the Drift tab.
Procedure: create a schedule#
- Open Compliance > Schedules and press New schedule.
- Fill the form Create new schedule:
| Field | Meaning |
|---|---|
| Schedule name * | For example "Nightly CIS Scan" |
| Description | Optional notes |
| Framework * | The framework to scan |
| Recurrence * | Hourly, Daily, Weekly or Monthly |
| Custom interval (minutes) | Optional. Overrides the recurrence; 5 to 10080 minutes |
| Target scope * | All agents, Specific agent (then Agent ID *, for example 42) or Platform (then Platform *, for example linux or windows) |
| Enable schedule immediately | Leave ticked to start at once; untick to create it switched off |
- Press Save schedule.
What you see: the schedule in the table with its Next run.
If it fails: the form shows the field in error (for example an interval outside 5-10080, or a missing agent ID). An Agent ID is the number shown for the host in Environment > Hosts.
Procedure: run a schedule now, pause it, change it, delete it#
Permission: Run scans. Four-eyes: no. Risk: none to hosts (scans only read). Rollback: a paused schedule is resumed with Enable; a deleted schedule is created again (23.1).
Each row of the table has four buttons under Actions: Run now (play), Disable or Enable (toggle), Edit (pencil) and Delete (bin).
To run it now:
- Open Compliance > Schedules and press Run now on the row.
- What you see: the scan starts at once and appears under Compliance > Overview > Active scans. The next run is counted from now.
To pause or resume it:
- Press Disable on the row. Future runs stop; nothing is lost.
- To resume, press Enable on the same row. Next run is filled in again.
To change it:
- Press Edit on the row. The form "Edit: <name>" opens with the current values.
- Change the fields (the same fields as in "Create a schedule" above).
- Press Save schedule. Cancel closes the form without a change.
To delete it:
- Press Delete on the row.
- Press Yes to confirm (No keeps it).
- What you see: the row disappears. Past scans stay in Scan history and their drift records stay in Drift.
If it fails: a red line under the row names the error (for example a permission refusal); the close mark on it dismisses it.
A schedule With errors shows its last error under its name in the table. Read it, fix the cause (for example a scope with no online agent), then Run now to confirm.
23.2 The Drift tab#
Path: Compliance > Drift. "Drift is read-only - it does not change control status."
What you see:
- Tiles: Regressions, New failures, Improvements, Total records.
- Filters: Search control ID, name, framework..., type (All types, Regressed, New failure, Improved, Changed, Not assessed change), severity, framework, Schedule ID, Clear x.
- Table: Severity, Type, Control, Framework, the change (previous -> current), Scan, Detected, Schedule.
| Type | Meaning | What to do |
|---|---|---|
| Regressed | Was passing, now fails | Re-run a scan to confirm, then create a hardening plan |
| New failure | Was not assessed, now fails | Investigate the cause, then harden |
| Improved | Now compliant | Nothing; confirm with the next scheduled scan |
| Changed | Status changed in another way | Compare both scans |
| Not assessed change | Moved from not assessed to a new state | Read the scan findings |
Click a row for the drift detail: Previous -> Current, the recommended action, Operator action required with a link to the linked review item (when one was created), Related context (Control ID, Control name, Framework, Current scan, Previous scan, Schedule, Detected) and Evidence.
Procedure: compare two scans on demand#
Use this to see what changed between any two completed scans of the same framework, for example before and after a maintenance window.
- Open Compliance > Drift and expand Compare scans on-demand.
- Enter Current scan ID * (the newer scan) and Previous scan ID * (the older scan). Scan IDs are in the scan page address and in Scan history.
- Tick Overwrite existing drift records for this scan pair only if you compared this pair before and want the records rebuilt.
- Press Compare.
What you see: a summary - Controls compared, Drift created, Regressions, New failures, Improvements, Changed, Unchanged, Not-Assessed - and "Refresh the drift list below to see the newly created records."
If it fails: the scans must both be completed and of the same framework; the message says which condition failed.
To fix a regression, open the scan and use its Fix plan (chapter 22).