How to change the order of posture conditions?

[dgaikwad]

Hi All,
Is there any way I could change the order of posture conditions?
This is under, Policy -> Posture?

I am using ISE 2.3.

Thank you,

[Timothy Abbott]

You can't change the order of rules under Policy > Posture and ultimately you don't need to. If you have more than one rule that applies to Windows endpoints (for example), each rule will apply.

Regards,
-Tim

[RichardAtkin]

I agree the order doesn’t matter, but when you’ve got lots of rules it would sometimes be good if you could sort them, particularly sort by OS, as it would make reading them easier.

[paul]

You can add more than one requirement to a rule to keep things neater.  Say you have a set of requirement for Windows Domain Computers.  Those requirements could all be in one rule.

[RichardAtkin]

Yes, but then reporting gets a bit less granular and troubleshooting gets a bit harder because if you hide lots of conditions in one rule, it’s less easy to know which one failed.

[Timothy Abbott]

You can sort them by OS. There is a search bar in the upper right hand corner of the posture policy screen with a drop down that lets you select operating system as the search criteria.

[RichardAtkin]

That button is a 'filter', not a 'sort'... still, I hadn't spotted it and it's better than nothing - thanks Tim.

[dgaikwad]

The reason I am asking is because I want to know if they are really run in a particular... Or does it run from top to bottom to report an endpoint either compliant or non-compliant?

[RichardAtkin]

It works like one large AND statement; all conditions that match your device are evaluated and reported upon, the order the rules are presented in has no significance how they are implemented.

[howon]

Are you trying to change order of the posture rules or conditions? If it for rules, you can prepend numbers in front of the rule name to force manual ordering; 01, 02, 03,,,. 

[dgaikwad]

Yes! That is exactly what I want to accomplish and the reason behind is that:
We have 3 conditions for SCCM and Anti-virus and manual remediation only in case if the any of them are not found installed.

So, if service is not running or disabled, auto remediate to start it.

If, service not found installed then, contact the administrator, is the message displayed.

While performing negative testing (uninstalled SCCM altogether), I found out that, posture check still gets stuck at checking for the service!!! Then times out after remediation timer!!

It's not going to find the service since the application does not exist on the endpoint!

So, that is what I am struggling with... so all this just to make the user experience a bit easier and reduce the number help desk calls...

[howon · Accepted solution]

You should order the requirements so it checks installation -> service status -> up-to-date. This way, if the application is not installed, then it will require user to take action without having to check to see if the service is running. Also, if if the application is installed, but not running, there is no need to check for Up-To-Date status. See sample below for an example posture policy rule requirement:

[dgaikwad]

This is a good way to order the posture checks.

The only reason we did not go for this approach was there was a need for individual rule from the customer, so that they could troubleshoot this easily when time needed.

But, then with this I have got the idea of checking the services as well as installation of the particular application.

Thank you,