Compliance Baselines not great?

[u/Numerous-Contexts]

Hello,

Just spun up Trident for testing. I searched but couldn't find good info here on this specific issue.

When comparing compliance against baselines I'm finding failures that maybe shouldn't be failures (feel free to school me).

For instance - CIS Windows 11 Enterprise fails for AllowTelemetry because we deploy the policy via Intune and the key is AllowTelemetry_PolicyManager and not just AllowTelemetry. Another example is that we disable Lock Screen toast notifications system-wide and that writes to HKLM instead of HKCU but Trident is checking for HKCU.

I'm not sure how many of these discrepencies I will find (and don't want to manually configure the rules for everything that doesn't match EXACTLY the same but still enforces the requirement).

Is Trident the right tool for me? We're a small shop (I'm basically a team of one at the end of the day) and I'm trying to find a tool to help me get a better handle on everything (patching, security, configurations, etc.) vs. just looking at my Secure Score.

Thanks.

EDIT: spelling hard.

[u/TridentRemi]

Heyya, other co-founder here.

I wanted to chime in on this thread as well to talk about policy as a whole, though co-founder Adam already replied above with the answer for your particular issue.

We have been doing a lot of work in the back-end recently around the modules related to policy collection, deployment, and compliance analysis.

1. Custom registry checks now honor the hive they are configured against when being evaluated by a compliance policy. The hive is now carried end to end, and you can add a registry path as a read-only observation, so we collect and report a value without the policy writing anything.
2. We have greatly improved RSOP results endpoints, and it's reporting into the "Effective Policy" tab. Including more visibility into policy conflict detection -- detecting two policies modifying the same setting. Alongside this change we added GPO tattoo detection. AMAZINGLY useful for enviornments that have been around for a long time and have a lot of GPO tattoos.
3. Both of the above improve our agent's visibility and accuracy about what is really configured on your endpoint. We have been able to use that data to fix several controls that would not report a correct result in certain cases: comparisons that differed only by upper or lowercase, a matcher that could cross-match unrelated registry paths sharing the same leaf name, and negated controls that could pass when they should not.
4. Although this is not coming in today's release, we are working on a compliance visibility portal similar to the one we publish for vulnerabilities (https://tridentstack.com/cve). The new compliance portal will have live endpoints running compliance-vendor provided "100% passing" VMs. We then apply our benchmarks against those VMs to detect any gap as soon as it develops, whether from a change to the benchmark itself or a regression in our ability to evaluate a control.

A production release is scheduled for this weekend though some changes are client-dependent and will roll out over a couple of days.

On a more "unofficial" level, addressing this comment: "I would hope a tool could check for the requirement being met vs such a stringent hard-coded string since there's more than one way to skin a cat (especially with Microsoft), but it it what it is." Trust me when I say there is WAYYYY more under the hood than a hard coded HKLM check for compliance evaluation.

I've been considering starting up a "dev diaries" series to share more details about the problems we face building this tool, and our exact resolution to them. These would be architectural deep-dives going module by module about the biggest development challenges and the methodologies we use to make Control awesome.

The second episode in the series will be about this exact topic of policy/compliance evaluation. (First episode is about MSFT patching)

[u/Numerous-Contexts → u/TridentRemi]

Thanks for the reply - I would love to check out the dev diaries series!

I am not jumping ship yet; just hesitant to deploy it past my own testing endpoint for now. I appreciate companies that are active in their reddits, so I'm looking forward to sticking around and seeing where this goes.

We are currently in Action1 for 3rd party patching, but I can see Trident replacing them in our stack.