How to use CSA in Guided Procedures

Creating a GP using a CSA PlugIn

Create a new Guided Procedure

The configuration of a Guided Procedure is either started by the tile ‘System Management – Guided Procedure Configuration' (up to FRUN 2.00 SP01) or within the tile ‘System Management – Guided Procedures' (as of FRUN 2.00 SP02):

Figure: Guided Procedure for Advanced System Management

Select application area ‘Guided Procedure for Advanced System Management', click on the ‘Add' button to create a new GP and enter a name and description:

Figure: Create New Guided Procedure

Note:
For release levels below FRUN 2.00 SP02 use button ‘Create' -> ‘New' of tile ‘System Management – Guided Procedure Configuration'.

If the Guided Procedure is only intended for local use in the system, then use $TMP as package name. Otherwise, choose a custom package to allow transporting.

Configuration

Switch to edit mode and enter a step name, description and a documentation:

Figure: Edit Guided Procedure

At ‘Step Content' click on button ‘New' at tabstrip ‘Automatic Activities':

Figure: Add a step content

Select the CSA Plugin and enter the technical policy name:

Figure: Select CSA PlugIn

Show Details:
If enabled, the final output will contain the corresponding check item results in plain text. Depending on the content of the selected policy it may happen that sensitive configuration data is disclosed to users who shall not have the authorization to see this data.

Note: In CSA, some config stores are protected with additional authorization checks. When running a policy from a Guided Procedure, the validation checks on these config stores are executed by the technical user GP background user that is allowed to read all stores.

Recommendation: Only enable ‘Show Details' if you are sure that the policy does not distribute security relevant information to the recipients. In general it is recommended to disable this feature. In this case the output does contain a link for a direct execution of the CSA validation displaying the policy results. This includes an authorization check of the end user.

CSA Policy:
The technical name of the CSA policy.

Display Only Non-Compliant Items:
The output will only display non-compliant items. This reduces the output in case the policy does contain many check items.

Relevant For:
Select the scope of the GP execution, either ‘Technical System' or ‘Database'. Here, the scope must match to the check items of the policy.

Confirm the step.

Report Configuration

Click on button ‚Report Configuration' and disable the options as shown.

Figure: Report Configuration

Finally, save and activate the GP using the corresponding buttons:

Figure: Save and activate

Running a GP

How to run a GP manually (since SAP Focused Run 2.00 SP02)

Select the Guided Procedure and click on run:

Figure: Running a Guided Procedure

Note:
In older releases use button ‘Execute' at tile ‘System Management – Guided Procedure Configuration'

Create a scope using the ‘Add' button:

Figure: Create new execution instance

Execute the GP:

Figure: Execute the Guided Procedure

How to schedule a GP in background (since SAP Focused Run 2.00 SP02)

Click on button ‘Add' at the Guided Procedure Planning:

Figure: Guided Procedure Planning

Note:
In older releases use button ‘Create Plan' at tile ‘System Management – Guided Procedure Configuration'

Choose the GP and enter a plan name:

Figure: Enter a plan name

Define the scope of the GP planning (here: All ABAP systems):

Figure: Define scope of GP planning

Define the schedule:

Figure: GP Planning schedule

In case the result is to be forwarded to a recipient list this must be maintained in the GP environment. In general, create a recipient list with report receivers and create a recipient list with “admin receivers” who will receive notification if GP job fails.

For details, please refer to the GP documentation.

Figure: Planning notification