Baseline Inspection Overview

Updated on 2025-01-20 GMT+08:00

View PDF

SecMaster can scan cloud services for risks in key configuration items, report scan results by category, generate alerts for incidents, and provide hardening suggestions and guidelines.

SecMaster can check key cloud service configurations for your workloads on the cloud based on preconfigured security standards Cloud Security Compliance Check 1.0 and Network Security. In addition, you can add check items and compliance packs to make custom compliance packs to meet your own needs.

Limitations and Constraints

The SecMaster basic and standard editions do not support custom check items or compliance packs.

Baseline Check Methods

Automated baseline checks
By default, SecMaster performs a check every three days. From 00:00 to 06:00, SecMaster checks all assets in the current region under your account based on compliance pack Cloud Security Compliance Check 1.0. The default check plan can be enabled or disabled only. No changes on its compliance packs or execution time can be made.
Scheduled custom baseline checks
You can customize the automatic check period, time, and scope. You can also customize the check items that can be automated in Cloud Security Compliance Check 1.0, Network Security, and Huawei Cloud Security Configuration. For details about how to perform a baseline inspection, see Performing a Scheduled Baseline Check.
Immediate baseline checks
You can start all security standards or a specific check plan to detect violations in real time. You can set auto check items in Cloud Security Compliance Check 1.0, Network Security, and Huawei Cloud Security Configuration packs. For check items that support only manual check, the system generates check items whose check results are To be checked. You need to perform a manual check offline and then report the check results to the SecMaster console. For details about immediate baseline checks, see Starting an Immediate Baseline Check.

You can start all security standards or a specific check plan to detect violations in real time. You can set the auto check items in the compliance packs. For check items that support only manual check, the system generates check items whose check results are To be checked. You need to perform a manual check offline and then report the check results to the SecMaster console. For details about immediate baseline checks, see Starting an Immediate Baseline Check.
- You can start all compliance packs in use to detect violations against automatic check items.
- You can start a check plan to detect violations against check items in the compliance pack configured in the check plan.
- You can select one or more check items and start them at once.
Manual baseline checks
There are some manual check items included in baseline inspection. After you finish a manual check, report the check results to SecMaster. The pass rate is calculated based on results from both manual and automatic checks. For automatic check items, you can manually start specific checks.

Some check items in Cloud Security Compliance Check 1.0 and Network Security are manual.

For details about manual checks, see Performing a Manual Baseline Check.

Process

The process of baseline inspection is as follows.

**Table 1** Process
No.	Operation	Description
1	Conducting a Scheduled Baseline Inspection	SecMaster uses the default check plan to check all assets. Default plan: SecMaster checks your assets under your account in the current region every three days from 00:00 to 06:00. Custom plans: SecMaster performs baseline inspections based on the compliance packs and time you specify in the custom check plans.
2	Starting an Immediate Baseline Check	The baseline inspection supports periodic and immediate checks. Periodic check: The system automatically executes the default check plan or the check plans you configure. Immediate check: You can add or modify a custom check plan and start the check plan immediately. In this way, you can check whether the servers have certain unsafe configurations in real time.
3	Viewing Baseline Inspection Results	You can view the baseline inspection results after each manual check or automated check. You can quickly learn affected assets and details about the baseline inspection items.
4	Handling Baseline Inspection Results	You can handle risky items based on the rectification suggestions.