Techniques for compliance testing
Described are techniques for performing compliance testing. Configuration state information is received for one or more devices managed using a configuration management system. The configuration state information is stored in a data container. One or more compliance tests are executed using the configuration state information to determine if the one or more devices are compliant. The one or more compliance tests are defined using one or more queries and one or more compliance rules. The one or more queries are used for retrieving a portion of said configuration state information from said data container and generating one or more result sets. The one or more compliance rules specifying compliance criteria are used for determining whether the one or more result sets include configuration state information which is compliant.
1. A method for compliance testing comprising:
receiving collected information for one or more entities;
executing one or more compliance tests using the collected information to determine whether the one or more entities are compliant with specified compliance criteria;
determining whether a first of the one or more entities fails a first of the compliance tests; and
responsive to determining that the first entity fails the first compliance test, automatically generating a corresponding remedial action, wherein first metadata describes a hierarchical object model including a first object and a second object included in the first object, the first metadata including a first remedial action atomicity level indicator for the first object indicating it is allowable for remedial action processing to generate the first object, the first metadata including a second remedial action atomicity level indicator for the second object indicating whether it is allowable for remedial action processing to generate the second object, said second object including a first portion corresponding to corrected information of the first entity, wherein said automatically generating the corresponding remedial action includes performing first processing comprising:
generating an object representation of expected information corresponding to successful compliance with the first compliance test, the expected information including the first portion corresponding to corrected information for the first entity, wherein said generating the object representation uses the first metadata and includes:
determining whether the second remedial action atomicity level indicator indicates it is allowable to generate the second object;
if the second remedial action atomicity level indicator indicates it is not allowable to generate the second object, generating the first object including the second object; and
if the second remedial action atomicity level indicator indicates it is allowable to generate the second object, generating the second object without requiring generation of other portions of the first object; and
processing the corresponding remedial action.
2. The method of claim 1 , wherein each of the one or more entities is a loan applicant, the one or more compliance tests use the collected information to determine whether each of the one or more loan applicants are compliant with specified compliance criteria to obtain a loan.
3. The method of claim 2 , wherein the corresponding remedial action includes any of adjusting a loan condition, increasing a loan interest rate, and increasing a down payment amount requirement.
4. The method of claim 1 , wherein each of the one or more entities is a code entity, the one or more compliance tests use the collected information to determine whether the one or more code entities are compliant with specified compliance criteria representing coding standards.
5. The method of claim 4 , wherein the first entity is a first code entity and the corresponding remedial action includes generating a revised code portion of the first code entity.
6. The method of claim 1 , wherein the collected information is stored in a data container and the one or more compliance tests are defined using one or more queries and one or more compliance rules.
7. The method of claim 6 , wherein the one or more queries retrieve a portion of the collected information from the data container and generate one or more result sets.
8. The method of claim 7 , wherein the one or more compliance rules specify compliance criteria used to determine whether the one or more result sets include information which is compliant.
9. The method of claim 1 , wherein the one or more compliance rules include any of a first type of rule defining one or more rows of information which are required to be included in the one or more result sets in order to determine that the one or more results sets include information which is compliant, a second type of rule defining rows of information which are required not to be included in the one or more result sets in order to determine that the one or more results sets include information which is compliant, and a third type of rule defining one or more attributes which are required to be included in each row of the one or more result sets in order to determine that the one or more results sets include information which is compliant.
10. A non-transitory computer readable medium comprising code stored thereon that, when executed, perform a method of compliance testing comprising:
receiving collected information for one or more entities;
executing one or more compliance tests using the collected information to determine whether the one or more entities are compliant with specified compliance criteria;
determining whether a first of the one or more entities fails a first of the compliance tests; and
responsive to determining that the first entity fails the first compliance test, automatically generating a corresponding remedial action, wherein first metadata describes a hierarchical object model including a first object and a second object included in the first object, the first metadata including a first remedial action atomicity level indicator for the first object indicating it is allowable for remedial action processing to generate the first object, the first metadata including a second remedial action atomicity level indicator for the second object indicating whether it is allowable for remedial action processing to generate the second object, said second object including a first portion corresponding to corrected information of the first entity, wherein said automatically generating the corresponding remedial action includes performing first processing comprising:
generating an object representation of expected information corresponding to successful compliance with the first compliance test, the expected information including the first portion corresponding to corrected information of the first entity, wherein said generating the object representation uses the first metadata and includes:
determining whether the second remedial action atomicity level indicator indicates it is allowable to generate the second object;
if the second remedial action atomicity level indicator indicates it is not allowable to generate the second object, generating the first object including the second object; and
if the second remedial action atomicity level indicator indicates it is allowable to generate the second object, generating the second object without requiring generation of other portions of the first object; and
processing the corresponding remedial action.
11. The non-transitory computer readable medium of claim 10 , wherein each of the one or more entities is a loan applicant, the one or more compliance tests use the collected information to determine whether the one or more loan applicants are compliant with specified compliance criteria to obtain a loan.
12. The non-transitory computer readable medium of claim 11 , wherein the corresponding remedial action includes any of adjusting a loan condition, increasing a loan interest rate, and increasing a down payment amount requirement.
13. The non-transitory computer readable medium of claim 10 , wherein each of the one or more entities is a code entity, the one or more compliance tests use the collected information to determine whether the one or more code entities are compliant with specified compliance criteria representing coding standards.
14. The non-transitory computer readable medium of claim 10 , wherein the first entity is a first code entity and the corresponding remedial action includes generating a revised code portion of the first code entity.
15. The non-transitory computer readable medium of claim 10 , wherein the collected information is stored in a data container and the one or more compliance tests are defined using one or more queries and one or more compliance rules.
16. The non-transitory computer readable medium of claim 15 , wherein the one or more queries retrieve a portion of the collected information from the data container and generate one or more result sets.
17. The non-transitory computer readable medium of claim 16 , wherein the one or more compliance rules specify compliance criteria used to determine whether the one or more result sets include information which is compliant.
18. The non-transitory computer readable medium of claim 10 , wherein the one or more compliance rules include any of a first type of rule defining one or more rows of information which are required to be included in the one or more result sets in order to determine that the one or more results sets include information which is compliant, a second type of rule defining rows of information which are required not to be included in the one or more result sets in order to determine that the one or more results sets include information which is compliant, and a third type of rule defining one or more attributes which are required to be included in each row of the one or more result sets in order to determine that the one or more results sets include information which is compliant.
19. A system comprising:
a processor;
a memory comprising code stored therein that, when executed, performs a method for compliance testing comprising:
receiving configuration state information for one or more devices managed using a configuration management system;
executing one or more compliance tests using the configuration state information to determine if the one or more devices are compliant;
determining whether a first of the one or more devices fails a first of the compliance tests; and
responsive to determining that the first device fails the first compliance test, automatically generating a corresponding remedial action including one or more device commands to make the first device compliant with an expected configuration state, wherein first metadata describes a hierarchical object model including a first object and a second object included in the first object, the first metadata including a first remedial action atomicity level indicator for the first object indicating it is allowable for remedial action processing to generate the first object, the first metadata including a second remedial action atomicity level indicator for the second object indicating whether it is allowable for remedial action processing to generate the second object, said second object including a first portion corresponding to corrected configuration state information of the first device, wherein said automatically generating the corresponding remedial action includes performing first processing comprising:
generating an object representation of expected configuration state information corresponding to successful compliance with the first compliance test, the expected configuration state information including the first portion corresponding to corrected configuration state information of the first device, wherein said generating the object representation uses the first metadata and includes:
determining whether the second remedial action atomicity level indicator indicates it is allowable to generate the second object;
if the second remedial action atomicity level indicator indicates it is not allowable to generate the second object, generating the first object including the second object; and
if the second remedial action atomicity level indicator indicates it is allowable to generate the second object, generating the second object without requiring generation of other portions of the first object; and
processing the corresponding remedial action.
20. The system of claim 19 , where the method further includes:
converting the object representation of the expected configuration state information to the one or more device commands.