Understanding Benchmark Application at Group and Tag Levels

Overview

This article explains how benchmarks are created and applied in Saner, the role of tags in targeting specific devices, and the limitations of applying multiple benchmarks within the same group.

Key Concepts

1. Benchmarks are created and applied at the group level.
   Each group can have only one active benchmark applied at a time. The configuration and compliance evaluation are managed based on this benchmark.
   
   

2. Tags can be used to filter devices within a group.
   If you want to apply a benchmark to specific devices, you can use the tag feature to filter and target those devices during benchmark creation or compliance checks.

Important Limitation

Within a single group, if multiple tags are assigned to different sets of devices and you attempt to apply different benchmarks to each tag, this is not supported.

When you create a new benchmark for the same group:

• The new benchmark will replace the existing one.

• The previously applied benchmark will be automatically removed, as observed.
  
  

This design ensures consistency and avoids conflicts in compliance evaluation within a single group.

Recommended Approach

If you need to apply different benchmarks to different sets of devices, follow this approach:

1. Create separate groups based on your tag-based segmentation.

   • For example, if you have devices tagged as Workstations and Servers, create two groups accordingly.

2. Move devices into their respective groups based on the desired benchmark scope.

3. Apply distinct benchmarks to each group.
   
   

This method provides:

• Clear separation of compliance baselines.

• Simplified management and reporting.

• Scalability for future benchmark customization.

Summary

Additional Assistance

For further guidance on organizing groups or applying benchmarks efficiently, contact SecPod Support at support@secpod.com.