关于配置CMDB健康度cmdb_health_result审计指标、合规仪表板及得分计算的问询

Hey there! Let's work through your CMDB questions one by one, drawing on my hands-on experience with these tools:

1. Configuring the cmdb_health_result Metric for Auditing #

Setting up this metric to track CMDB health for audits involves defining validation rules and enabling audit logging:

• Navigate to your instance's CMDB Health Configuration (usually under Administration > CMDB Health > Metric Definitions).
• Locate the cmdb_health_result system metric—you can customize its underlying rules to align with your audit requirements:
  • Define attribute validation rules: Specify mandatory CI attributes (e.g., asset tag, owner), valid format constraints (like valid IPs or MAC addresses), and reference data matches (e.g., OS versions approved by your org).
  • Set up relationship integrity checks: Ensure critical CI relationships (e.g., application → database, server → rack) exist and are correctly mapped.
  • Assign rule weightings (if your system supports it): Prioritize high-impact rules (like compliance with regulatory requirements) with higher weights to reflect their importance.
• Enable audit tracking for the metric: Toggle the "Audit Logging" option to record every update to cmdb_health_result, including which rules triggered score changes and when they occurred.
• Run a baseline health scan to generate initial metric values and confirm the configuration works as expected.

2. Configuring the CMDB Compliance Dashboard #

Building a useful compliance dashboard involves curating relevant widgets and aligning it with your team's needs:

• Access your instance's Dashboard Builder or dedicated CMDB Compliance module.
• Create a new dashboard (name it something like "CMDB Compliance Scorecard") and add these key widgets:
  • A scorecard widget: Display the overall compliance percentage (this is the 57% you're seeing).
  • Rule breakdown widgets: Show pass/fail counts for individual compliance rules (e.g., mandatory attribute checks, relationship validation) to identify gaps.
  • Trend widgets: Track compliance score changes over time to measure improvements or spot regressions.
• Apply filters to focus on specific CI classes (e.g., servers, network devices) or business units if you need segmented visibility.
• Set up scheduled refreshes (daily or weekly) to ensure the dashboard always shows the latest compliance status.
• Share the dashboard with stakeholders (auditors, IT operations) using role-based access controls to restrict or grant visibility as needed.

3. Understanding the Compliance Score Calculation #

The discrepancy between your audit's 43% (397/916) and the dashboard's 57% score almost always comes down to weighted rule scoring. Here's how it typically works:

• Unweighted pass rate (43%): This is the raw count of passed rule checks divided by the total number of checks. In your case, 397 out of 916 total rule evaluations passed—no consideration for how important each rule is.
• Weighted overall score (57%): Your system assigns a weight to each compliance rule based on its impact. For example:
  • A critical rule (e.g., "Server has a valid security patch level") might have a weight of 10.
  • A minor rule (e.g., "Server has a department tag") might have a weight of 2.
• The total weighted score is calculated by summing the weights of all passed rules, then dividing by the sum of all possible rule weights. If the rules you're passing carry higher weights, this will boost the overall percentage above the raw pass count.
• To confirm this, check your compliance rule configuration—you'll see weight values assigned to each rule that explain the difference between the two percentages.

内容的提问来源于stack exchange，提问作者Done With Fun