Welcome
Compliance Setup Guide and User Guide
BigFix Compliance Analytics is a web-based application designed to help you manage security, vulnerability, and risk assessment. The application archives security and vulnerability compliance check results to identify configuration issues and report levels of compliance toward security configuration goals.
BigFix Compliance Analytics Setup Guide
Introduction
BigFix Compliance Analytics is a component of BigFix Compliance, that aggregates and reports on the compliance statuses of all endpoints against deployed policies that are continually collected, aggregated, and reported using a powerful Compliance Analytics engine, database and user interface.
Port requirements
When planning the infrastructure, ensure that port numbers used by BigFix Compliance, BigFix, and the database are free to enable communication between those components.
Flow of data
There are several different interactions that occur between the components of the BigFix Compliance infrastructure and between the user and the tool.

BigFix Documentation Homepage
BigFix 11 Compliance Documentation
Welcome to the BigFix Compliance documentation, where you can find information about how to install, maintain, and use BigFix Compliance.
BigFix Platform
BigFix Query
Compliance Overview
BigFix Compliance helps support endpoint security throughout your organization.
Compliance Guides in PDF format
Following is a list of links to the BigFix Compliance user guides in PDF format:
SCM Checklists Guide
This SCM Checklists page provides information about the compliance checklists supported by BigFix Compliance, including frameworks, supported platforms, and checklist versions.
Compliance Setup Guide and User Guide
BigFix Compliance Analytics is a web-based application designed to help you manage security, vulnerability, and risk assessment. The application archives security and vulnerability compliance check results to identify configuration issues and report levels of compliance toward security configuration goals.
- BigFix Compliance Analytics Setup Guide
  - Introduction
    BigFix Compliance Analytics is a component of BigFix Compliance, that aggregates and reports on the compliance statuses of all endpoints against deployed policies that are continually collected, aggregated, and reported using a powerful Compliance Analytics engine, database and user interface.
    - System Requirements
      Set up your deployment according to the system requirements to successfully deploy BigFix Compliance Analytics.
    - Setup Considerations
      When configuring your system, ensure that your ideal deployment size aligns with your hardware specifications. Utilize the provided recommendations as general guidance to effectively set up BigFix Compliance Analytics for optimal performance.
    - Port requirements
      When planning the infrastructure, ensure that port numbers used by BigFix Compliance, BigFix, and the database are free to enable communication between those components.
      - Flow of data
        There are several different interactions that occur between the components of the BigFix Compliance infrastructure and between the user and the tool.
      - Firewall exceptions
        Some of the fixlets require that the BigFix server connects to the Internet and downloads necessary files and updates. To ensure that they can be downloaded, relevant web addresses must be accessible from the computer where the server is installed. Add those addresses as firewall exceptions and ensure that they are accessible to the proxy server if you are using it.
  - Installing BigFix Compliance Analytics
    Follow this comprehensive guide to successfully deploy and configure the BigFix Compliance for optimal performance and data insights.
  - Uninstalling
    To remove BigFix Compliance from your infrastructure, stop the application-specific actions and analyses that are running on the computers and uninstall the scanner. Remove the VM Manager tool. Subsequently, uninstall the BigFix Compliance server, and optionally eliminate the associated database as well.
  - Configuring report definitions using REST API
    Administrators can use REST API to create, update, and delete saved report view definitions across BFC instances.
  - Disaster recovery for BigFix Compliance Analytics
    Use the standard cold standby method of creating a backup and restoring the system in your disaster recovery plan for BigFix Compliance Analytics.
- BigFix Compliance Analytics User Guide
  BigFix Compliance Analytics is a component of BigFix Compliance, that includes technical controls and tools that are based on industry practices and standards for endpoint and server security configuration.
Configuration Management (SCM)
BigFix Compliance Configuration Management (SCM) includes configurable content such as checks and checklists, which assess and manage devices to ensure compliance standards are met.
Client Manager for Endpoint Protection
BigFix Compliance CMEP is an effective tool to monitor the deployment and health status of various Endpoint Protection products and provide quick remediation actions to recover needed endpoint protection.
BigFix Client Compliance
This guide describes the BigFix Client Compliance and its solutions (BigFix Client Compliance Configuration and BigFix Client Compliance Windows (IPSec Framework)) which helps in maintaining the compliance status of the computers.
Middleware Application Patching
Middleware Application Patching is an important process for organizations to ensure their systems are secure and up to date. By applying the appropriate patches and security updates, organizations can minimize the risk of malicious attacks and potential data loss. BigFix users can enjoy unified patch management by using a single platform for deploying database and middleware patches.
RBI Compliance User Guide
Discover how the RBI Compliance Report provides a centralized and automated reporting solution for monitoring device and Fixlet compliance.
Technical References
Find technical reference material for BigFix® Compliance components. The topics in this section cover release notes, tool specifications, and version details for Compliance components, including Security Configuration Automation Protocol (SCAP), Security Compliance Analytics (SCA), and related tools.
BigFix Remediate
BigFix MCM
Glossary
This glossary provides terms and definitions for the BigFix® Compliance software and products.

Flow of data

There are several different interactions that occur between the components of the BigFix Compliance infrastructure and between the user and the tool.

Diagram illustrating the flow of data within BigFix Compliance

BigFix Compliance domain

Table 1. Data flow in the BigFix Compliance domain
Label	Interaction	Attribute	Description
A	Web browser data traffic	Port	By default, the web browser connects to the BigFix Compliance server using port 9081 (HTTPS). You can disable the SSL/TLS connection tunneling.
A	Web browser data traffic	Origination	The web browser connects to the BigFix Compliance server.
B	REST API data traffic	Port	By default, the client connects to the BigFix Compliance server using port 9081 (HTTPS). You can disable the secure connection.
B	REST API data traffic	Origination	A client that uses REST API connections.

BigFix domain

Table 2. Data flow in the BigFix domain
Label	Interaction	Attribute	Description
C	BigFix Console data traffic	Port	Consoles connect to the root server using HTTPS 52311 for all interactions.
		Origination	The BigFix console connects to the RootServer service.
		Network controls	There is a refresh rate for each BigFix console user (default 15 seconds).
D	Gather, post, download	Port	Port 52311 is configurable by the BigFix administrator at installation time.
		Origination	The BigFix client initiates the request to the BigFix relay or server.
		Network controls	Configurable bandwidth throttling to BigFix relay or clients. Configurable gather interval (default: 1 per day per fixlet site). Configurable minimum time to wait between posts (default 15 seconds). Configurable temporal distribution (spread downloads over time) per action. Ability to set policy to prevent computers from downloading files if they are not pointed at the proper BigFix relay.
E	UDP "new information" message	Port	Port 52311 is configurable by the BigFix administrator at installation time.
		Origination	The UDP messages are sent from the immediate parent of the BigFix clients, which can be either a BigFix relay or server.
		Network controls	Configurable limit of the number of UDP messages sent at one time from a BigFix relay. Configurable limit of the amount of time to wait after sending UDP messages from a BigFix relay.
F	Relay selection	Port	The ICMP protocol does not use a port.
		Origination	Each BigFix client sends progressive "rounds" of ICMP packets to each relay with increasing TTLs until a BigFix relay responds. The BigFix client then chooses the closest relay.
		Network controls	Relay auto-selection can be disabled. Configurable interval for when the BigFix clients perform auto-selection. Configurable limit on the maximum number of ICMP packets to send out in a time interval. Configurable limit on the maximum number of rounds to send out during relay auto-selection.
G	New data download from external BigFix fixlet servers	Port	80 (typically); possibly 21, 443.
		Origination	The BigFix server connects to the BigFix fixlet servers.
		Network controls	There is a configurable interval for when the BigFix server checks for new fixlet messages.

The following database protocols are used:

ODBC
JDBC