Add [role="_abstract"] to Managing Security Compliance (#4299)

aneta-petrova · aneta-petrova · commit f31c50cbf26b · 2025-10-03T08:24:49.000+02:00
* Add [role=_abstract] * Group SCAP cons and refs in an assembly This will help with adjusting the abstracts. * Regroup modules in Configuring compliance methods assembly * Identify and move abstract-type info to abstract (cherry picked from commit 12cd0e6)
diff --git a/guides/common/assembly_configuring-compliance-policy-deployment-methods.adoc b/guides/common/assembly_configuring-compliance-policy-deployment-methods.adoc
@@ -2,8 +2,8 @@
 
 include::modules/con_configuring-compliance-policy-deployment-methods.adoc[]
 
+include::modules/ref_compliance-policy-deployment-options.adoc[leveloffset=+1]
+
 include::modules/proc_configuring-project-for-ansible-compliance-policy-deployment.adoc[leveloffset=+1]
 
 include::modules/proc_configuring-project-for-puppet-compliance-policy-deployment.adoc[leveloffset=+1]
-
-include::modules/con_configuring-project-for-manual-compliance-policy-deployment.adoc[leveloffset=+1]
diff --git a/guides/common/assembly_security-compliance-management-in-project.adoc b/guides/common/assembly_security-compliance-management-in-project.adoc
@@ -0,0 +1,5 @@
+include::modules/con_security-compliance-management-in-project.adoc[]
+
+include::modules/con_security-content-automation-protocol.adoc[leveloffset=+1]
+
+include::modules/con_scap-content-in-project.adoc[leveloffset=+1]
diff --git a/guides/common/modules/con_compliance-email-notifications.adoc b/guides/common/modules/con_compliance-email-notifications.adoc
@@ -3,6 +3,9 @@
 [id="Compliance_Email_Notifications_{context}"]
 = Compliance email notifications
 
+[role="_abstract"]
+You can configure email notifications on your {ProjectServer} to stay informed about compliance policy changes.
+
 {ProjectServer} sends an OpenSCAP Summary email to all users who subscribe to the *Compliance policy summary* email notifications.
 For more information on subscribing to email notifications, see {AdministeringDocURL}Configuring_Email_Notification_Preferences_admin[Configuring Email Notification Preferences] in _{AdministeringDocTitle}_.
 
diff --git a/guides/common/modules/con_configuring-compliance-policy-deployment-methods.adoc b/guides/common/modules/con_configuring-compliance-policy-deployment-methods.adoc
@@ -3,5 +3,6 @@
 [id="configuring-compliance-policy-deployment-methods_{context}"]
 = Configuring compliance policy deployment methods
 
+[role="_abstract"]
 Use one the following procedures to configure {Project} for the method that you have selected to deploy compliance policies.
 You will select one of these methods when you later xref:common/modules/proc_creating-a-compliance-policy.adoc#Creating_a_Compliance_Policy_{context}[create a compliance policy].
diff --git a/guides/common/modules/con_configuring-project-for-manual-compliance-policy-deployment.adoc b/guides/common/modules/con_configuring-project-for-manual-compliance-policy-deployment.adoc
diff --git a/guides/common/modules/con_configuring-scap-contents.adoc b/guides/common/modules/con_configuring-scap-contents.adoc
@@ -3,4 +3,5 @@
 [id="Configuring_SCAP_Contents_{context}"]
 = Configuring SCAP contents
 
+[role="_abstract"]
 You can upload SCAP data streams and tailoring files to define compliance policies.
diff --git a/guides/common/modules/con_deploying-compliance-policies.adoc b/guides/common/modules/con_deploying-compliance-policies.adoc
@@ -3,4 +3,5 @@
 [id="deploying-compliance-policies_{context}"]
 = Deploying compliance policies
 
+[role="_abstract"]
 To deploy a compliance policy, you must install the SCAP client, update the cron schedule file, and upload the SCAP content selected in the policy onto a host.
diff --git a/guides/common/modules/con_managing-compliance-policies.adoc b/guides/common/modules/con_managing-compliance-policies.adoc
@@ -3,6 +3,7 @@
 [id="Managing_Compliance_Policies_{context}"]
 = Managing compliance policies
 
+[role="_abstract"]
 A _compliance policy_ is a scheduled audit that checks the specified hosts for compliance against a specific XCCDF profile from a SCAP content.
 
 You specify the schedule for scans on {ProjectServer} and the scans are performed on hosts.
diff --git a/guides/common/modules/con_monitoring-compliance.adoc b/guides/common/modules/con_monitoring-compliance.adoc
@@ -3,6 +3,7 @@
 [id="Monitoring_Compliance_{context}"]
 = Monitoring compliance
 
+[role="_abstract"]
 With {Project}, you can centralize compliance monitoring and management.
 A compliance dashboard provides an overview of compliance of hosts and the ability to view details for each host within the scope of that policy.
 Compliance reports provide a detailed analysis of compliance of each host with the applicable policy.
diff --git a/guides/common/modules/con_scap-content-in-project.adoc b/guides/common/modules/con_scap-content-in-project.adoc
@@ -3,10 +3,13 @@
 [id="SCAP_Content_in_{project-context}_{context}"]
 = SCAP content in {Project}
 
+[role="_abstract"]
+In {Project}, you use an XCCDF profile from SCAP content and, eventually, a tailoring file, to define a _compliance policy_.
+{Project} includes default SCAP contents from SCAP Security Guide provided by the https://www.open-scap.org/[OpenSCAP project].
+
 SCAP content is a SCAP data-stream file that contains implementation of compliance, configuration, or security baselines.
 A single data stream usually includes multiple XCCDF profiles.
 An XCCDF profile defines an industry standard or custom security standard against which you can evaluate compliance of host configuration in {Project}, such as Protection Profile for General Purpose Operating Systems (OSPP), Health Insurance Portability and Accountability Act (HIPAA), and PCI-DSS v3.2.1 Control Baseline for {EL}{nbsp}9.
 You can adapt existing XCCDF profiles according to your requirements by using _tailoring files_.
 
-In {Project}, you use an XCCDF profile from SCAP content and, eventually, a tailoring file, to define a _compliance policy_.
-{Project} includes default SCAP contents from SCAP Security Guide provided by the https://www.open-scap.org/[OpenSCAP project].
+{Project} supports content of SCAP versions 1.2 and 1.3.
diff --git a/guides/common/modules/con_security-compliance-management-in-project.adoc b/guides/common/modules/con_security-compliance-management-in-project.adoc
@@ -1,10 +1,8 @@
 :_mod-docs-content-type: CONCEPT
 
-[id="security-compliance-management_{context}"]
-= Security compliance management
+[id="security-compliance-management-in-project"]
+= Security compliance management in {Project}
 
+[role="_abstract"]
 Security compliance management is the ongoing process of defining security policies, auditing systems for compliance with those policies, and resolving instances of non-compliance.
-Any non-compliance is managed according to the organization's configuration management policies.
-Security policies range in scope from host-specific to industry-wide, therefore, flexibility in their definition is required.
-
 With {Project}, you can schedule compliance auditing and reporting on all registered hosts.
diff --git a/guides/common/modules/con_security-content-automation-protocol.adoc b/guides/common/modules/con_security-content-automation-protocol.adoc
@@ -3,6 +3,7 @@
 [id="Security_Content_Automation_Protocol_{context}"]
 = Security content automation protocol
 
+[role="_abstract"]
 {Project} uses the Security Content Automation Protocol (SCAP) standard to define security policies.
 
 SCAP is a framework of several specifications based on XML, such as checklists described in the Extensible Checklist Configuration Description Format (XCCDF) and vulnerabilities described in the Open Vulnerability and Assessment Language (OVAL).
diff --git a/guides/common/modules/con_tailoring-xccdf-profiles.adoc b/guides/common/modules/con_tailoring-xccdf-profiles.adoc
@@ -3,6 +3,7 @@
 [id="tailoring-xccdf-profiles_{context}"]
 = Tailoring XCCDF profiles
 
+[role="_abstract"]
 You can customize existing XCCDF profiles by using _tailoring files_ without editing the original SCAP content.
 A single tailoring file can contain customizations of multiple XCCDF profiles.
 
diff --git a/guides/common/modules/proc_applying-remote-scap-resources-in-a-disconnected-environment.adoc b/guides/common/modules/proc_applying-remote-scap-resources-in-a-disconnected-environment.adoc
@@ -3,6 +3,7 @@
 [id="applying-remote-scap-resources-in-a-disconnected-environment_{context}"]
 = Applying remote SCAP resources in a disconnected environment
 
+[role="_abstract"]
 SCAP data streams can contain remote resources, such as OVAL files, that the SCAP client can fetch over the internet when it runs on hosts.
 If your hosts do not have internet access, you must download remote SCAP resources and distribute them from {ProjectServer} to your hosts as local files by {ContentManagementDocURL}Downloading_Files_to_a_Host_from_a_Custom_File_Type_Repository_content-management[downloading the files on hosts from a {customfiletype} repository].
 
diff --git a/guides/common/modules/proc_configuring-project-for-ansible-compliance-policy-deployment.adoc b/guides/common/modules/proc_configuring-project-for-ansible-compliance-policy-deployment.adoc
@@ -3,6 +3,7 @@
 [id="configuring-{project-context}-for-ansible-compliance-policy-deployment"]
 = Configuring {Project} for Ansible compliance policy deployment
 
+[role="_abstract"]
 If you want to use Ansible to deploy compliance policies, configure {Project} for Ansible compliance policy deployment.
 
 .Procedure
diff --git a/guides/common/modules/proc_configuring-project-for-puppet-compliance-policy-deployment.adoc b/guides/common/modules/proc_configuring-project-for-puppet-compliance-policy-deployment.adoc
@@ -3,6 +3,7 @@
 [id="configuring-{project-context}-for-puppet-compliance-policy-deployment"]
 = Configuring {Project} for Puppet compliance policy deployment
 
+[role="_abstract"]
 If you want to use Puppet to deploy compliance policies, configure {Project} for Puppet compliance policy deployment.
 
 .Procedure
diff --git a/guides/common/modules/proc_creating-a-compliance-policy.adoc b/guides/common/modules/proc_creating-a-compliance-policy.adoc
@@ -3,6 +3,7 @@
 [id="Creating_a_Compliance_Policy_{context}"]
 = Creating a compliance policy
 
+[role="_abstract"]
 By creating a compliance policy, you can define and plan your security compliance requirements, and ensure that your hosts remain compliant to your security policies.
 
 .Prerequisites
diff --git a/guides/common/modules/proc_deleting-a-compliance-policy.adoc b/guides/common/modules/proc_deleting-a-compliance-policy.adoc
@@ -3,6 +3,7 @@
 [id="Deleting_a_Compliance_Policy_{context}"]
 = Deleting a compliance policy
 
+[role="_abstract"]
 In the {ProjectWebUI}, you can delete existing compliance policies.
 
 .Prerequisites
diff --git a/guides/common/modules/proc_deleting-a-compliance-report.adoc b/guides/common/modules/proc_deleting-a-compliance-report.adoc
@@ -3,6 +3,7 @@
 [id="Deleting_a_Compliance_Report_{context}"]
 = Deleting a compliance report
 
+[role="_abstract"]
 You can delete compliance reports on your {Project}.
 
 .Prerequisites
diff --git a/guides/common/modules/proc_deleting-multiple-compliance-reports.adoc b/guides/common/modules/proc_deleting-multiple-compliance-reports.adoc
@@ -3,6 +3,7 @@
 [id="Deleting_Multiple_Compliance_Reports_{context}"]
 = Deleting multiple compliance reports
 
+[role="_abstract"]
 You can delete multiple compliance policies simultaneously.
 However, in the {ProjectWebUI}, compliance policies are paginated, so you must delete one page of reports at a time.
 ifdef::satellite[]
diff --git a/guides/common/modules/proc_deploying-a-policy-in-a-host-group-using-ansible.adoc b/guides/common/modules/proc_deploying-a-policy-in-a-host-group-using-ansible.adoc
@@ -3,6 +3,7 @@
 [id="Deploying_a_Policy_in_a_Host_Group_Using_Ansible_{context}"]
 = Deploying a policy in a host group using Ansible
 
+[role="_abstract"]
 After you deploy a compliance policy in a host group using Ansible, the Ansible role installs the SCAP client and configures OpenSCAP scans on the hosts according to the selected compliance policy.
 
 The SCAP content in the compliance policy might require remote resources.
diff --git a/guides/common/modules/proc_deploying-a-policy-in-a-host-group-using-puppet.adoc b/guides/common/modules/proc_deploying-a-policy-in-a-host-group-using-puppet.adoc
@@ -3,6 +3,7 @@
 [id="Deploying_a_Policy_in_a_Host_Group_Using_Puppet_{context}"]
 = Deploying a policy in a host group using Puppet
 
+[role="_abstract"]
 After you deploy a compliance policy in a host group using Puppet, the Puppet agent installs the SCAP client and configures OpenSCAP scans on the hosts on the next Puppet run according to the selected compliance policy.
 
 The SCAP content in your compliance policy might require remote resources.
diff --git a/guides/common/modules/proc_deploying-a-policy-on-a-host-using-ansible.adoc b/guides/common/modules/proc_deploying-a-policy-on-a-host-using-ansible.adoc
@@ -3,6 +3,7 @@
 [id="Deploying_a_Policy_on_a_Host_Using_Ansible_{context}"]
 = Deploying a policy on a host using Ansible
 
+[role="_abstract"]
 After you deploy a compliance policy on a host using Ansible, the Ansible role installs the SCAP client and configures OpenSCAP scans on the host according to the selected compliance policy.
 
 The SCAP content in the compliance policy might require remote resources.
diff --git a/guides/common/modules/proc_deploying-a-policy-on-a-host-using-puppet.adoc b/guides/common/modules/proc_deploying-a-policy-on-a-host-using-puppet.adoc
@@ -3,6 +3,7 @@
 [id="Deploying_a_Policy_on_a_Host_Using_Puppet_{context}"]
 = Deploying a policy on a host using Puppet
 
+[role="_abstract"]
 After you deploy a compliance policy on a host using Puppet, the Puppet agent installs the SCAP client and configures OpenSCAP scans on the host on the next Puppet run according to the selected compliance policy.
 
 The SCAP content in your compliance policy might require remote resources.
diff --git a/guides/common/modules/proc_editing-a-compliance-policy.adoc b/guides/common/modules/proc_editing-a-compliance-policy.adoc
@@ -3,6 +3,7 @@
 [id="Editing_a_Compliance_Policy_{context}"]
 = Editing a compliance policy
 
+[role="_abstract"]
 In the {ProjectWebUI}, you can edit compliance policies.
 
 Puppet agent applies an edited policy to the host on the next run.
diff --git a/guides/common/modules/proc_enabling-openscap.adoc b/guides/common/modules/proc_enabling-openscap.adoc
@@ -3,6 +3,7 @@
 [id="enabling-openscap"]
 = Enabling OpenSCAP
 
+[role="_abstract"]
 ifdef::satellite[]
 The OpenSCAP plugin is enabled on your {ProjectServer} by default.
 endif::[]
diff --git a/guides/common/modules/proc_getting-scap-contents-for-enterprise-linux.adoc b/guides/common/modules/proc_getting-scap-contents-for-enterprise-linux.adoc
@@ -3,6 +3,7 @@
 [id="getting-scap-contents-for-enterprise-linux"]
 = Getting SCAP contents for {EL}
 
+[role="_abstract"]
 You can get the packaged SCAP Security Guide (SSG) for {EL} from its default operating system repositories.
 
 // Example is for Rocky Linux because that's the only Client OS that is not part of https://github.com/ComplianceAsCode/content
diff --git a/guides/common/modules/proc_getting-scap-contents-from-upstream.adoc b/guides/common/modules/proc_getting-scap-contents-from-upstream.adoc
@@ -3,6 +3,7 @@
 [id="getting-scap-contents-from-upstream"]
 = Getting SCAP contents from upstream
 
+[role="_abstract"]
 You can get the latest SCAP Security Guide (SSG) for various client operating systems from upstream.
 
 .Procedure
diff --git a/guides/common/modules/proc_getting-supported-scap-contents-for-rhel.adoc b/guides/common/modules/proc_getting-supported-scap-contents-for-rhel.adoc
@@ -3,6 +3,7 @@
 [id="getting-supported-scap-contents-for-rhel_{context}"]
 = Getting supported SCAP contents for RHEL
 
+[role="_abstract"]
 You can get the latest SCAP Security Guide (SSG) for {RHEL} on the Red Hat Customer Portal.
 You have to get a version of SSG that is designated for the minor RHEL version of your hosts.
 
diff --git a/guides/common/modules/proc_listing-available-scap-contents-using-cli.adoc b/guides/common/modules/proc_listing-available-scap-contents-using-cli.adoc
@@ -3,6 +3,7 @@
 [id="listing-available-scap-contents-using-cli"]
 = Listing available SCAP contents using CLI
 
+[role="_abstract"]
 Use this procedure to view what SCAP contents are already loaded in {Project}.
 
 .Prerequisites
diff --git a/guides/common/modules/proc_listing-available-scap-contents-using-web-ui.adoc b/guides/common/modules/proc_listing-available-scap-contents-using-web-ui.adoc
@@ -3,6 +3,7 @@
 [id="listing-available-scap-contents-using-web-ui"]
 = Listing available SCAP contents using {ProjectWebUI}
 
+[role="_abstract"]
 Use this procedure to view what SCAP contents are already loaded in {Project}.
 
 .Prerequisites
diff --git a/guides/common/modules/proc_loading-the-default-scap-contents.adoc b/guides/common/modules/proc_loading-the-default-scap-contents.adoc
@@ -3,6 +3,7 @@
 [id="Loading_the_Default_SCAP_Contents_{context}"]
 = Loading the default SCAP contents
 
+[role="_abstract"]
 By loading the default SCAP contents on {ProjectServer}, you ensure that the data streams from the SCAP Security Guide (SSG) are loaded and assigned to all organizations and locations.
 
 SSG is provided by the operating system of {ProjectServer} and installed in `/usr/share/xml/scap/ssg/content/`.
diff --git a/guides/common/modules/proc_remediating-compliance-failures.adoc b/guides/common/modules/proc_remediating-compliance-failures.adoc
@@ -3,6 +3,7 @@
 [id="remediating-compliance-failures_{context}"]
 = Remediating compliance failures
 
+[role="_abstract"]
 With {Project}, you can examine compliance reports and, in some cases, remediate cases of non-compliance.
 You can remediate compliance failures by using a remediation wizard or by applying remediation snippets manually.
 
diff --git a/guides/common/modules/proc_running-a-security-compliance-scan-on-demand.adoc b/guides/common/modules/proc_running-a-security-compliance-scan-on-demand.adoc
@@ -3,6 +3,7 @@
 [id="running-a-security-compliance-scan-on-demand_{context}"]
 = Running a security compliance scan on demand
 
+[role="_abstract"]
 Hosts perform OpenSCAP scans regularly by the CRON schedule defined in the compliance policies assigned to hosts.
 However, you can also run a scan on a host for all configured compliance policies manually at any time.
 
diff --git a/guides/common/modules/proc_searching-compliance-reports.adoc b/guides/common/modules/proc_searching-compliance-reports.adoc
@@ -3,6 +3,7 @@
 [id="Searching_Compliance_Reports_{context}"]
 = Searching compliance reports
 
+[role="_abstract"]
 Use the Compliance Reports search field to filter the list of available reports on any subset of hosts.
 
 .Procedure
diff --git a/guides/common/modules/proc_uploading-a-tailoring-file.adoc b/guides/common/modules/proc_uploading-a-tailoring-file.adoc
@@ -3,6 +3,7 @@
 [id="Uploading_a_Tailoring_File_{context}"]
 = Uploading a tailoring file
 
+[role="_abstract"]
 After uploading a tailoring file, you can apply it in a compliance policy to customize an XCCDF profile.
 
 .Prerequisites
diff --git a/guides/common/modules/proc_uploading-additional-scap-content-using-cli.adoc b/guides/common/modules/proc_uploading-additional-scap-content-using-cli.adoc
@@ -3,6 +3,7 @@
 [id="uploading-additional-scap-content-using-cli"]
 = Uploading additional SCAP content using CLI
 
+[role="_abstract"]
 You can upload additional SCAP content into {ProjectServer}, either content created by yourself or obtained elsewhere.
 ifdef::satellite[]
 Note that {Team} only provides support for SCAP content obtained from {Team}.
diff --git a/guides/common/modules/proc_uploading-additional-scap-content-using-web-ui.adoc b/guides/common/modules/proc_uploading-additional-scap-content-using-web-ui.adoc
@@ -3,6 +3,7 @@
 [id="uploading-additional-scap-content-using-web-ui"]
 = Uploading additional SCAP content using {ProjectWebUI}
 
+[role="_abstract"]
 You can upload additional SCAP content into {ProjectServer}, either content created by yourself or obtained elsewhere.
 ifdef::satellite[]
 Note that {Team} only provides support for SCAP content obtained from {Team}.
diff --git a/guides/common/modules/proc_viewing-a-compliance-policy.adoc b/guides/common/modules/proc_viewing-a-compliance-policy.adoc
@@ -3,6 +3,7 @@
 [id="Viewing_a_Compliance_Policy_{context}"]
 = Viewing a compliance policy
 
+[role="_abstract"]
 You can preview the rules which will be applied by specific OpenSCAP content and profile combination.
 This is useful when you plan policies.
 
diff --git a/guides/common/modules/proc_viewing-compliance-policy-statistics.adoc b/guides/common/modules/proc_viewing-compliance-policy-statistics.adoc
@@ -3,6 +3,7 @@
 [id="Viewing_Compliance_Policy_Statistics_{context}"]
 = Viewing compliance policy statistics
 
+[role="_abstract"]
 You can view a compliance policy dashboard to verify compliance reports of a particular policy.
 The compliance policy dashboard provides a statistical summary of compliance of hosts and the ability to view report details for each host within the scope of that policy.
 
diff --git a/guides/common/modules/ref_compliance-policy-deployment-options.adoc b/guides/common/modules/ref_compliance-policy-deployment-options.adoc
@@ -3,6 +3,9 @@
 [id="compliance-policy-deployment-options_{context}"]
 = Compliance policy deployment options
 
+[role="_abstract"]
+With {Project}, multiple methods are available for compliance policy deployment.
+
 You can use one of the following methods to deploy compliance policies:
 
 Ansible deployment::
@@ -13,3 +16,10 @@ You use a Puppet class and the Puppet agent to configure hosts for compliance sc
 
 Manual deployment::
 You manually configure hosts for compliance scans.
++
+For the manual deployment method, no additional {Project} configuration is required.
+
+ifdef::satellite[]
+.Additional resources
+* https://access.redhat.com/solutions/6389101[How to set up OpenSCAP Policies using Manual Deployment option in the _Red{nbsp}Hat Knowledgebase_]
+endif::[]
diff --git a/guides/common/modules/ref_inclusion-of-remote-scap-resources.adoc b/guides/common/modules/ref_inclusion-of-remote-scap-resources.adoc
@@ -3,7 +3,10 @@
 [id="inclusion-of-remote-scap-resources_{context}"]
 = Inclusion of remote SCAP resources
 
+[role="_abstract"]
 SCAP data streams can reference remote resources, such as OVAL files, that the SCAP client fetches over the internet when it runs on hosts.
+You can enable the download of these remote resources for hosts with internet access.
+
 If a data stream requires a remote resource, you can see a warning from the OpenSCAP Scanner tool on your {ProjectServer}, such as:
 
 [options="nowrap", subs="+quotes,verbatim,attributes"]
diff --git a/guides/common/modules/ref_supported-scap-versions.adoc b/guides/common/modules/ref_supported-scap-versions.adoc
diff --git a/guides/doc-Managing_Security_Compliance/master.adoc b/guides/doc-Managing_Security_Compliance/master.adoc
@@ -23,15 +23,7 @@ ifdef::satellite[]
 include::common/modules/proc_providing-feedback-on-red-hat-documentation.adoc[leveloffset=+1]
 endif::[]
 
-include::common/modules/con_security-compliance-management.adoc[leveloffset=+1]
-
-include::common/modules/con_security-content-automation-protocol.adoc[leveloffset=+1]
-
-include::common/modules/con_scap-content-in-project.adoc[leveloffset=+1]
-
-include::common/modules/ref_supported-scap-versions.adoc[leveloffset=+2]
-
-include::common/modules/ref_compliance-policy-deployment-options.adoc[leveloffset=+1]
+include::common/assembly_security-compliance-management-in-project.adoc[leveloffset=+1]
 
 include::common/modules/proc_enabling-openscap.adoc[leveloffset=+1]
 
