Project VCM Agent Context

1 collect evidence playbooks/collect_evidence.yml
2 main roles/compliance_evidence/tasks/main.yml
3 main roles/compliance_evaluate/tasks/main.yml
4 defender windows roles/compliance_evidence/tasks/defender_windows.yml
5 defender linux roles/compliance_evidence/tasks/defender_linux.yml
6 rapid7 windows roles/compliance_evidence/tasks/rapid7_windows.yml
7 rapid7 linux roles/compliance_evidence/tasks/rapid7_linux.yml
8 sccm roles/compliance_evidence/tasks/sccm.yml
9 wsus roles/compliance_evidence/tasks/wsus.yml
10 aap roles/compliance_evidence/tasks/aap.yml
11 main roles/compliance_evidence/vars/main.yml
12 main roles/compliance_evidence/defaults/main.yml

---

1. Rapid7 Insight Agent, Linux.

- name: Rapid7 linux probe
ansible.builtin.shell: |
set +e
INSTALLED=false
RUNNING=false
AGE=-1
[ -x {{ ce_linux.rapid7_binary }} ] && INSTALLED=true
systemctl is-active —quiet {{ ce_linux.rapid7_service }} && RUNNING=true

LOG=$(ls -t /opt/rapid7/ir_agent/components/insight_agent/common/*.log 2>/dev/null | head -1) if [ -n “$LOG” ]; then MT=$(stat -c %Y “$LOG” 2>/dev/null) if [ -n “$MT” ]; then NOW=$(date -u +%s) AGE=$(echo “scale=2; ($NOW – $MT) / 3600” | bc) fi fi echo “${INSTALLED} ${RUNNING} ${AGE}” args: executable: /bin/bash register: ce_rapid7_lnx changed_when: false failed_when: false

- name: Record rapid7 result
ansible.builtin.set_fact:
ce_result_rapid7:
installed: “{{ (ce_rapid7_lnx.stdout | trim).split(’ ’)⁰ | bool }}”
service_running: “{{ (ce_rapid7_lnx.stdout | trim).split(’ ’)¹ | bool }}”
last_checkin_hours: >-
{{ none if ((ce_rapid7_lnx.stdout | trim).split(’ ‘)² | float) < 0
else ((ce_rapid7_lnx.stdout | trim).split(’ ‘)² | float) }}
probe_error: "{{ ce_rapid7_lnx.stdout | default(’’) | trim | length == 0 }}"

---

---

1. SCCM client. Windows, domain joined only.
2. Registration is the real test. A client can be installed, running and
3. assigned to a site while never having registered with the MP.
4. LastMPServerName plus a recent policy request is the health signal.

- name: SCCM probe
ansible.windows.win_shell: |
$ErrorActionPreference = ‘SilentlyContinue’
$out = [ordered]@{
installed = $false
service_running = $false
registered = $false
site_code = $null
mp_server = $null
client_version = $null
last_checkin_hours = $null
}

$svc = Get-Service -Name ‘{{ ce_windows.sccm_service }}’ if ($svc) { $out.installed = $true $out.service_running = ($svc.Status -eq ‘Running’) } $sms = Get-CimInstance -Namespace ‘root\ccm’ -ClassName ‘SMS_Client’ if ($sms) { $out.installed = $true $out.client_version = $sms.ClientVersion } $reg = Get-CimInstance -Namespace ‘root\ccm’ -ClassName ‘CCM_ClientIdentificationInformation’ if ($reg) { $out.registered = [bool]$reg.ClientId } $sc = (New-Object -ComObject ‘Microsoft.SMS.Client’).GetAssignedSite() if ($sc) { $out.site_code = $sc } $mp = Get-ItemProperty -Path ‘HKLM:\SOFTWARE\Microsoft\CCM’ -Name ‘LastMPServerName’ if ($mp) { $out.mp_server = $mp.LastMPServerName }

1. Most recent successful policy request from the policy agent log.
   $pl = ‘C:\Windows\CCM\Logs\PolicyAgent.log’
   if (Test-Path $pl) {
   $out.last_checkin_hours = [math]::Round(
   ((Get-Date).ToUniversalTime() – (Get-Item $pl).LastWriteTimeUtc).TotalHours, 2)
   }

$out | ConvertTo-Json -Compress register: ce_sccm changed_when: false failed_when: false

- name: Record sccm result
ansible.builtin.set_fact:
ce_result_sccm: >-
{{ (ce_sccm.stdout | trim | from_json)
if (ce_sccm.stdout | default(‘’) | trim | length > 0)
else { ’installed’: none, ‘service_running’: none,
‘last_checkin_hours’: none, ‘probe_error’: true } }}

---

---

1. WSUS. Windows, standalone only.
2. There is no agent here, so the contract keys map differently.
3. installed means the policy points at a WSUS server.
4. service_running means the Windows Update service is up.
5. last_checkin_hours comes from the last detection time.

- name: WSUS probe
ansible.windows.win_shell: |
$ErrorActionPreference = ‘SilentlyContinue’
$out = [ordered]@{
installed = $false
configured = $false
service_running = $false
server = $null
use_wsus_server = $null
last_checkin_hours = $null
}

$key = ‘{{ ce_windows.wsus_key }}’ if (Test-Path $key) { $p = Get-ItemProperty -Path $key if ($p.WUServer) { $out.server = $p.WUServer $out.configured = $true $out.installed = $true } } if (Test-Path “$key\AU”) { $au = Get-ItemProperty -Path “$key\AU” $out.use_wsus_server = ($au.UseWUServer -eq 1) } $svc = Get-Service -Name ‘wuauserv’ if ($svc) { $out.service_running = ($svc.Status -eq ‘Running’) } $lt = (New-Object -ComObject ‘Microsoft.Update.AutoUpdate’).Results.LastSearchSuccessDate if ($lt) { $out.last_checkin_hours = [math]::Round( ((Get-Date).ToUniversalTime() – $lt.ToUniversalTime()).TotalHours, 2) } $out | ConvertTo-Json -Compress register: ce_wsus changed_when: false failed_when: false

- name: Record wsus result
ansible.builtin.set_fact:
ce_result_wsus: >-
{{ (ce_wsus.stdout | trim | from_json)
if (ce_wsus.stdout | default(‘’) | trim | length > 0)
else { ’installed’: none, ‘service_running’: none,
‘last_checkin_hours’: none, ‘probe_error’: true } }}

---

---

1. AAP onboarding.
2. Circular validation guard: inventory presence alone proves nothing,
3. the vSphere dynamic source adds every VM whether managed or not.
4. Reachability is the part that actually means something, and we have
5. already proven it by getting this far in the play.

- name: Record aap result
ansible.builtin.set_fact:
ce_result_aap:
installed: true
in_inventory: true
service_running: true
reachable: true
inventory_source: “{{ vmc_inventory_source | default(‘vsphere_dynamic’) }}”
connection_plugin: “{{ ansible_connection | default(‘unknown’) }}”
last_checkin_hours: 0
inventory_sync_age_hours: “{{ vmc_inventory_sync_age_hours | default(none) }}”

---

---

1. Service and path constants. Change here, not in task files.

ce_windows:
defender_service: Sense
defender_av_service: WinDefend
defender_status_key: ‘HKLM:\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status’
rapid7_service: ir_agent
rapid7_path: ‘C:\Program Files\Rapid7\Insight Agent’
sccm_service: CcmExec
wsus_key: ‘HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate’

ce_linux:
defender_binary: /usr/bin/mdatp
defender_service: mdatp
rapid7_binary: /opt/rapid7/ir_agent/ir_agent
rapid7_service: ir_agent

---

---

1. Compliance thresholds
   ce_checkin_threshold_hours: 24

1. Control enablement. Flip to false to skip a control entirely.
   ce_controls_enabled:
   defender: true
   rapid7: true
   sccm: true
   wsus: true
   aap: true

1. Domain state drives SCCM vs WSUS applicability.
2. Set by the calling playbook. Default assumes standalone so we never
3. assert SCCM compliance on a host we have not confirmed as joined.
   ce_domain_joined: false

1. Where the assembled evidence lands on the controller when
2. ce_write_artifact is true. Report only mode uses this.
   ce_write_artifact: false
   ce_artifact_dir: /var/lib/awx/vmc_reports