Red Hat Security: Linux in Physical, Virtual, and Cloud
This course is now legacy content
This course is using an outdated version of the technology and is now considered to be Legacy content. It will be removed from our catalog on June 28, 2024. Please be sure to complete your course and finish any remaining labs before that date. We recommend moving to version 9.2, which is the latest version currently available.
Objectives
After completing this section, students should be able to review and interpret issue reports provided by Red Hat Insights in your Red Hat Satellite web interface.
Viewing Reports provided by Red Hat Insights
A Red Hat Insights report shows the state of a system over time. This can help you improve your IT environment's state. With these reports, you can easily view current assessments of risk and identify historical trends in order to enhance your decision making.
Whether you access it through the Customer Portal or a Red Hat Satellite Server, the Red Hat Insights interface provides you with information that includes:
A current overall risk score based on your registered systems.
Recommended actions to take on your systems, which is further broken down into categories and severities.
Information on when systems last checked in with Red Hat Insights.
Issues that need to be prioritized based on their impact.
Using the Red Hat Insights Interface on the Customer Portal
The Red Hat Insights web UI on the Customer Portal provides the following tabs:
- Overview
The Overview tab provides a high-level dashboard displaying the status of your systems.
Its Latest section provides news updates and announcements from Red Hat. The Newest Systems section shows the names of the systems you most recently registered with Red Hat Insights, with links to information about them. The Actions Summary provides a summary and links to recommended actions you should take on your systems, categorized as
Low,Medium,High, andCriticalseverities. The Plan Summary and Rules Summary provide information about maintenance plans you have added and analysis rules that Red Hat has added in the past 15 days.- Actions
The Actions tab provides a more detailed overview of recommended actions.
The Issues chart displays the total number of issues that affect your systems, and the percentage of issues that are in different categories:
Availability,Stability,Performance, andSecurity. You can click on different parts of the chart to get more detailed information.It also displays the Risk summary bar graph categorizing your issues by risk, as displayed on the Overview tab. You can also click on the bars on that graph for more detailed information.
Figure 11.4: Actions page in Insights customer portal- Inventory
The Inventory tab provides a list of the systems you have registered with Red Hat Insights.
You can easily filter the inventory for specific systems, groups, or supported platforms. The Last Check In column displays the time of the most recent metadata update for each system. The Status column lists the number of pending actions for each system, linked to information about those actions for that system.
- Planner
The Planner tab lists your current maintenance plans and allows you to create, edit, and delete them. A maintenance plan allows you to select issues that affect specific systems from your Red Hat Insights reports, select between various options on how to handle them, and generate an Ansible Playbook to mitigate or remediate them.
Maintenance plans are covered in more detail in a later section.
- Rules
The Rules tab provides a list of the rules that Red Hat Insights can use when analyzing your systems for issues.
These rules can be filtered based on age, total risk, category, likelihood, and impact on the registered systems.
In the Customer Portal interface, you will notice some of these issues are marked with the Ansible logo. This indicates the issue has an Ansible remediation playbook available. The issues with a dimmed, crossed-out Ansible logo do not have an Ansible remediation playbook, but may have manual mitigation or remediation instructions in the issue details.
- Executive Report
The Executive Report tab provides a current overall score for your systems based on historical data. You can export the Executive Report into a PDF document in order to easily share it.
Figure 11.5: Executive Report page in Insights on the Customer PortalImportant
You must have at least 10 systems registered with Red Hat Insights for the Executive Report to be generated.
- Configuration
The Configuration tab controls configuration settings for the Red Hat Insights service on the Customer Portal. For example, you can configure it to send you a weekly summary report in email, adjust whether systems registered through your Red Hat Satellite are displayed in the Customer Portal, and so on.
Note
The user interface in Red Hat Satellite is very similar to the Insights Customer Portal, but most of the tabbed items in the Customer Portal are menu items under the menu in Red Hat Satellite.
There are a handful of other minor differences. For example, Red Hat Satellite does not have the Configuration tab on its menu, but it does have a menu item that is used to configure Satellite's connection to Red Hat Insights.
Viewing Issues Reported by Insights in Red Hat Insights
To view issues reported by Insights in the Insights Customer Portal, the overall process is as follows:
Log in to Red Hat Insights through Customer Portal at
https://access.redhat.com/insights.On the portal, navigate to the Overview tab, view all your registered systems in the Newest Systems section. The Actions Summary section provides percentage of actions required based on low, medium, and high severity.
Navigate to the Actions tab, provided more information about the security, stability, and critical issues. Click on the graph representing the percentage to see more details for these issues.
Navigate to the Inventory tab. The page list all the registered systems.
Click the registered system. The page lists all the issues affecting the system.
Interpreting Red Hat Insights Reports
In Red Hat Insights, its rules determine the issues it looks for on your systems. Red Hat frequently adds new rules to Red Hat Insights to check for newly identified issues. Rules may look for incidents that have occurred on your system that indicate a problem, or they may proactively anticipate problems based on your system's current configuration.
When a rule matches your system, indicating that an issue exists, additional information is provided with the rule to help you understand the issue, prioritize work to address it, determine what mitigation or remediation is available, and to help you automate its resolution.
Each rule is categorized by type, and has a summary name and a longer description to explain what the issue is. Rules are normally linked to Knowledgebase articles on the Customer Portal with additional information. The Knowledgebase article may provide information about different ways to mitigate or remediate a problem, and Ansible Playbooks or other materials may be provided by the rule to help automate mitigation and remediation.
Some problems are complex to address, and a complete fix may require a reboot or downtime. In that case, there may be options to mitigate the issues by reducing its risk as a temporary measure. The rule will provide scores of the risk presented by the issue, in several different categories.
For example, consider a security issue that requires a kernel update and reboot to fix, but which also can be made very hard to exploit through certain temporary configuration changes. You might choose to apply the temporary changes immediately, and defer the reboot until you can schedule an emergency maintenance window.
Red Hat Insights categorizes the risk that an issue presents to your system into four categories.
It evaluates the level of that risk using these levels: Very Low, Low, Moderate, and High.
The Likelihood, Impact, Total Risk, and Risk of change categories forecast the risk factors of an issue detected on your subscribed systems.
ImpactIndicates the predicted level of impact to the system by this issue.
LikelihoodIndicates the likelihood that a given issue will impact the system.
Total RiskThe combination of
LikelihoodandImpactsets theTotal Riskscore.Risk of changeIndicates the risk that the recommended remediation action could cause disruption to a system.
To view the risk factors forecast by various rules in the Red Hat Insights Customer Portal, navigate to Actions, or to the Rules tab. Each rule shows the icon for Likelihood, Impact, Total Risk, and Risk of change.
 |
When you have identified the issues you want to address, you can address them manually or automatically. After the issue has been resolved, and your Insights client has uploaded new metadata, the rule should no longer match that system and the issue should disappear from the list of recommended actions that affect your systems.
Manually Remediating an Issue Reported by Insights
Log in to the Red Hat Insights portal at
https://access.redhat.com/insights.On the portal, navigate to the Inventory tab. Click the registered system. The page lists all the issues affecting the system.
Expand the security issue you plan to remediate. The Steps to resolve section provides information on how to resolve the issue.
Perform the steps on the affected system to resolve the issue.
After applying the remediation steps, run the following command as
rooton the system to report the changes to the Insights portal:[root@demo ~]#insights-clientStarting to collect Insights data for demo.lab.example.com Uploading Insights data. Successfully uploaded report from773b351b-dfb1-4393-afa8-915cc2875e06to accountxxxxxx.In the
Insightsportal, navigate to the Inventory tab. Click the system name in the System Name column, and verify that the issue no longer appears in the list of issues.
Viewing Insights Reports in Red Hat Satellite
Working with Red Hat Insights through Red Hat Satellite's web UI is similar to the way you work with it on the Customer Portal. Most interface items are listed under the menu. Many of the items on that menu match tabs in the Customer Portal interface, but some exceptions exist.
For example, there is no equivalent in the Satellite interface to the Configuration tab, because that controls settings relevant to the actual Red Hat Insights service on the Customer Portal. The closest equivalent would be → , which controls the integration between Red Hat Satellite and the remote Insights service.
Another example is → . This menu item displays an inventory of all machines registered through Satellite Server to Red Hat Insights. You can use it to view additional information about the state of each system and the recommended actions you should take by clicking on each host name.
 |
Watch this video as the instructor shows how to manually remediate an issue reported by Insights through the Red Hat Satellite Server's web UI.
Demonstration: Remediating an Issue Reported by Insights in Satellite Server UI
When the client system is registered, navigate to → in the Satellite UI. The page lists registered systems, actions summary (highlighted by priority) as well as latest updates from Red Hat.
Navigate to → . Click on the system name of the client to list issues affecting the host.
Select an issue that needs to be resolved. The Steps to resolve section provides information on how to resolve the issue.
Perform the recommended steps to resolve the issue on the system. Execute the following command to upload the updated system report to Red Hat Insights immediately after resolving the issue.
[root@demo ~]#insights-clientStarting to collect Insights data for demo.lab.example.com Uploading Insights data. Successfully uploaded report from773b351b-dfb1-4393-afa8-915cc2875e06to accountxxxxxx.Note
Manually running insights-client is not necessary unless you want to immediately update the system's metadata on Red Hat Insights. A
systemdtimer automatically runs insights-client daily, with a randomized delay of up to four hours. This makes it less likely that many systems will update simultaneously.In the Satellite UI, navigate to → . Click the client's host name to verify that the issue no longer appears in the list of issues.
 |
References
More information on feature updates for Red Hat Insights at https://access.redhat.com/documentation/en-us/red_hat_insights/1.0/html-single/release_notes/#release_information
