[BESAdmin-Announcements] BigFix Compliance: SCM Checklist Updates for Scan Exclusions, DISA IDs, and Environment Setup Task

[Announcements for BES Administrators]

*Product:* BigFix Compliance

*Title:* BigFix Compliance: SCM Checklist Updates for Scan Exclusions, DISA
IDs, and Environment Setup Task

We have released three updates to BigFix Compliance SCM checklists,
covering scan exclusion, task reliability, and reporting accuracy. This
post gives a brief overview of each, with documentation links where
available.

*Note:** These changes will be applied to checklists published going
forward. Checklists that are already published will be updated during the
next refresh.*

*1. Persistent scan exclusions for the Deploy and Run Scan task (Linux
checklists)*

For Linux checklists, you can now configure and store scan exclusions
directly on the endpoint, so they are reused across scan runs without
re-entering them each time. Two new tasks, Add Scan Exclusions and Remove
Scan Exclusions, let you manage exclusions for directories, mount points,
filesystem types, and the inode threshold. Saved values are applied
automatically on later scans, and the Take Action inputs are used when no
saved value exists.

For details, see
https://help.hcl-software.com/bigfix/11.0/compliance/Compliance/SCM_Users_Guide/c_modify_filesystem_scan_option_linux.html

*2. Corrected DISA STIG ID and DISA CCI ID (STIG checklists)*

We have corrected the DISA STIG ID and DISA CCI ID metadata for STIG
checklists. Previously, the DISA STIG ID showed inaccurate data and the
DISA CCI ID was blank, both in SCA and in the check description in the
console. This has been fixed so the values now reflect the correct data
from the DISA benchmark. In SCA, the DISA CCI ID column shows the CCI ID,
the DISA VulId (STIG ID) column shows the STIG ID, and the Source ID column
shows the Vulnerability ID. The same information is available in the check
description in the console. This makes it easier to cross-reference
findings against external scanners and DISA guidance.

*3. More reliable Environment Setup task (Middleware and NIX checklists)*

For Middleware and NIX checklists, the Environment Setup task now uses an
atomic results refresh. Previously, the task removed the existing results
before generating new ones, which could briefly cause checks to report as
Non-Compliant or Not Applicable if the client evaluated during that window.
The task now keeps the existing results until the new results are fully
generated, then swaps them in, so a valid set of results is always
available. Each result also carries a timestamp showing when it was
collected.

For details, see
https://help.hcl-software.com/bigfix/11.0/compliance/Compliance/SCM_Users_Guide/c_environment_setup-task_mw.html

*More information*

To learn more about BigFix Compliance SCM checklists, see the BigFix Forum:
https://forum.bigfix.com/c/release-announcements/scm-checklists/86

We hope you find these improvements useful, and we welcome your feedback.

The BigFix Compliance team
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://bigmail.bigfix.com/pipermail/besadmin-announcements/attachments/20260730/8ae4bead/attachment.html>