HIP Profile Objects

Host Information Profile (HIP) profile objects combine multiple HIP objects to create comprehensive endpoint compliance policies in Strata Cloud Manager. The scm CLI provides commands to create, update, delete, show, backup, and load HIP profile objects.

Overview

The hip-profile commands allow you to:

• Create profiles that reference multiple HIP objects
• Define match criteria with boolean logic in JSON format
• Delete HIP profiles that are no longer needed
• Bulk import HIP profiles from YAML files
• Export HIP profiles for backup or migration

Match Criteria Format

Match criteria use JSON format with HIP object references:

{
  "hip-object-name": {
    "is": true
  }
}

Multiple objects use AND logic (all conditions must match). Use "is": false for negative matching.

Set HIP Profile

Create or update a HIP profile object.

Syntax

scm set object hip-profile NAME [OPTIONS]

Arguments

Argument	Description	Required
NAME	Name of the HIP profile (max 31 characters)	Yes

Options

Option	Description	Required
--folder TEXT	Folder location	Yes*
--snippet TEXT	Snippet location	Yes*
--device TEXT	Device location	Yes*
--match TEXT	Match criteria in JSON format (max 2048 characters)	Yes
--description TEXT	Description (max 255 characters)	No

* Exactly one of --folder, --snippet, or --device is required.

Examples

Create Basic HIP Profile

$ scm set object hip-profile basic-compliance \
    --folder Texas \
    --match '{"windows-patches": {"is": true}}' \
    --description "Basic Windows patch compliance"
---> 100%
Created HIP profile: basic-compliance in folder Texas

Create Multi-Object Compliance Profile

$ scm set object hip-profile secure-endpoints \
    --folder Texas \
    --match '{"windows-patches": {"is": true}, "disk-encryption": {"is": true}, "antivirus": {"is": true}}' \
    --description "Comprehensive endpoint security"
---> 100%
Created HIP profile: secure-endpoints in folder Texas

Delete HIP Profile

Delete a HIP profile object from SCM.

Syntax

scm delete object hip-profile NAME [OPTIONS]

Arguments

Argument	Description	Required
NAME	Name of the HIP profile object to delete	Yes

Options

Option	Description	Required
--folder TEXT	Folder location	Yes*
--snippet TEXT	Snippet location	Yes*
--device TEXT	Device location	Yes*
--force	Skip confirmation prompt	No

* Exactly one of --folder, --snippet, or --device is required.

Example

$ scm delete object hip-profile secure-endpoints --folder Texas --force
---> 100%
Deleted HIP profile: secure-endpoints from folder Texas

Load HIP Profiles

Load multiple HIP profile objects from a YAML file.

Syntax

scm load object hip-profile [OPTIONS]

Options

Option	Description	Required
--file TEXT	Path to YAML file containing HIP profile definitions	Yes
--folder TEXT	Override folder location for all objects	No
--snippet TEXT	Override snippet location for all objects	No
--device TEXT	Override device location for all objects	No
--dry-run	Preview changes without applying them	No

YAML File Format

---
hip_profiles:
  - name: basic-windows
    folder: Texas
    description: "Basic Windows compliance"
    match: '{"windows-patches": {"is": true}}'

  - name: secure-windows
    folder: Texas
    description: "Secure Windows endpoints"
    match: '{"windows-patches": {"is": true}, "disk-encryption": {"is": true}, "antivirus": {"is": true}}'

  - name: corporate-windows
    folder: Texas
    description: "Corporate Windows requirements"
    match: '{"corp-domain": {"is": true}, "windows-security": {"is": true}, "disk-encryption": {"is": true}}'

  - name: secure-mac
    folder: Texas
    description: "Secure macOS endpoints"
    match: '{"macos-patches": {"is": true}, "filevault": {"is": true}}'

Examples

Load with Original Locations

$ scm load object hip-profile --file hip-profiles.yml
---> 100%
✓ Loaded HIP profile: basic-windows
✓ Loaded HIP profile: secure-windows
✓ Loaded HIP profile: corporate-windows
✓ Loaded HIP profile: secure-mac

Successfully loaded 4 out of 4 HIP profiles from 'hip-profiles.yml'

Load with Folder Override

$ scm load object hip-profile --file hip-profiles.yml --folder Austin
---> 100%
✓ Loaded HIP profile: basic-windows
✓ Loaded HIP profile: secure-windows
✓ Loaded HIP profile: corporate-windows
✓ Loaded HIP profile: secure-mac

Successfully loaded 4 out of 4 HIP profiles from 'hip-profiles.yml'

note

When using container override options (--folder, --snippet, --device), all HIP profiles will be loaded into the specified container, ignoring the container specified in the YAML file.

Show HIP Profile

Display HIP profile objects.

Syntax

scm show object hip-profile [NAME] [OPTIONS]

Arguments

Argument	Description	Required
NAME	Name of the HIP profile object to show; omit to list all	No

Options

Option	Description	Required
--folder TEXT	Folder location	Yes*
--snippet TEXT	Snippet location	Yes*
--device TEXT	Device location	Yes*
--max-results INTEGER	Maximum number of results to display	No
--output [table|json|yaml]	Output format (default: table)	No

* Exactly one of --folder, --snippet, or --device is required.

note

When no NAME argument is provided, all items are listed by default.

Examples

Show Specific HIP Profile

$ scm show object hip-profile secure-endpoints --folder Texas
---> 100%
HIP Profile: secure-endpoints
  Location: Folder 'Texas'
  Match: {"windows-patches": {"is": true}, "disk-encryption": {"is": true}, "antivirus": {"is": true}}
  Description: Comprehensive endpoint security
  ID: 123e4567-e89b-12d3-a456-426614174000

List All HIP Profiles (Default Behavior)

$ scm show object hip-profile --folder Texas
---> 100%
HIP Profiles in folder 'Texas':
------------------------------------------------------------
Name: basic-compliance
  Location: Folder 'Texas'
  Match: {"windows-patches": {"is": true}}
  Description: Basic Windows patch compliance
------------------------------------------------------------
Name: secure-endpoints
  Location: Folder 'Texas'
  Match: {"windows-patches": {"is": true}, "disk-encryption": {"is": true}, "antivirus": {"is": true}}
  Description: Comprehensive endpoint security
------------------------------------------------------------
Name: windows-corporate
  Location: Folder 'Texas'
  Match: {"corp-domain": {"is": true}, "windows-security": {"is": true}}
  Description: Corporate Windows requirements
------------------------------------------------------------

Backup HIP Profiles

Backup all HIP profile objects from a specified location to a YAML file.

Syntax

scm backup object hip-profile [OPTIONS]

Options

Option	Description	Required
--folder TEXT	Folder to backup HIP profiles from	No*
--snippet TEXT	Snippet to backup HIP profiles from	No*
--device TEXT	Device to backup HIP profiles from	No*
--file TEXT	Output filename (defaults to auto-generated)	No

* One of --folder, --snippet, or --device is required.

Examples

Backup from Folder

$ scm backup object hip-profile --folder Texas
---> 100%
Successfully backed up 8 HIP profiles to hip-profile_folder_texas_20240115_120530.yaml

Backup with Custom Filename

$ scm backup object hip-profile --folder Texas --file texas-hip-profiles.yaml
---> 100%
Successfully backed up 8 HIP profiles to texas-hip-profiles.yaml

Best Practices

1. Modular HIP Objects: Create focused HIP objects that can be combined in profiles.
2. Progressive Requirements: Start with basic requirements and add more for higher security tiers.
3. Platform-Specific Profiles: Create separate profiles for different operating systems.
4. Clear Naming: Use descriptive names that indicate the compliance level.
5. Documentation: Always include descriptions explaining the profile's purpose.
6. Use YAML for Bulk Operations: For complex deployments, use YAML files.
7. Organize by Container: Keep profiles organized in appropriate folders, snippets, or devices.