Set up compliance checks

Require services on or off per group, make exceptions, and add your own config rules.

Before you begin

You need Manage settings for groups and rules, and Edit devices for device exceptions.

Inventory > Groups, edit a group.
Under Compliance, choose for Telnet, SSH, HTTP and HTTPS: Must be off, Must be on or Not set.
Save. Inner groups inherit it and can override it.

A common baseline for a management network:

Edit the device and choose Not checked, Must be off or Must be on for that service. As the group says keeps the group's requirement.

Open Compliance. Under Config rules, press New rule.
Give it a name, choose must contain or must not contain, and enter the text.
Choose a severity, and optionally limit it to one platform or one group.
Tick The text is a regular expression if it is one. Regular expressions are checked line by line, so ^ and $ match the start and end of a line.

Examples: logging host 10.0.0.50 must be there, snmp-server community public must not. The rule list shows how many devices pass and which fail.

The Compliance page lists every device against its requirements. The device page shows where each requirement comes from.