Skip to main content

State Model

Use this guide to understand how Compliance Engine represents the lifecycle of each finding over time.

Per‑Asset, Per‑Policy Findings​

For every combination of asset (CMDB object) and policy, Compliance Engine maintains an output object that reflects the current status of that pair. This object evolves as evaluations run and the asset’s configuration changes.

States​

Each finding can be in one of several states:

  • Compliant – the asset satisfies the policy’s conditions.
  • Incompliant – the asset violates the policy.
  • Inapplicable – the policy does not apply to the asset (for example, prerequisites are missing).
  • Closed/Out of Scope – the asset is no longer evaluated by the policy (for example, deleted or excluded).

See also: Status Transitions.

Timestamps and History​

To support historical analysis, findings track:

  • When a status was first entered (for example, “Incompliant Start Date”).
  • When that status ended (for example, “Incompliant End Date”) because the asset changed state.
  • When the finding was closed due to scope loss (for example, “Close Date”).

Each time a policy evaluation runs:

  • If the finding’s status changes (for example, Compliant → Incompliant), the old status end timestamp is set and the new status start timestamp is recorded.
  • If the asset is no longer in scope, the finding is closed and a close timestamp is recorded.

This history allows Compliance Engine to answer questions such as:

  • How long has this asset been incompliant?
  • When did it become compliant again?
  • When did it stop being relevant for this policy?

Using the State Model in Reporting​

The state model underpins many KPIs, including:

  • Mean time to remediate (MTTR) – derived from incompliant start and end timestamps.
  • Current violation age – derived from incompliant start date for open findings.
  • Benchmark posture over time – computed by aggregating compliant vs. incompliant findings across policies.

Because findings are stored as persistent objects rather than ephemeral scan results, you can reconstruct posture at past points in time, which is especially valuable during audits.