I wrote a deep dive on the Compliance blade in Harmony Endpoint, part of a series I keep on the CheckMates community.

Compliance is the gatekeeper that decides whether a machine is healthy enough to stay on the network, and it quietly remediates when it is not. Two things trip people up the most:

1. Restriction is not instant. A non-compliant machine with a Restrict action walks a state machine paced by the heartbeat (default 60 seconds), re-evaluated every heartbeat. It sits in "about to be restricted" first, then after the configured number of heartbeats (default 5) it enters Restricted. Time to restriction is heartbeats x interval, about 5 minutes with defaults.
2. Required vs Prohibited logic is backwards from what people expect. A Required Application rule triggers if any one check object is non-compliant. A Prohibited Application rule only triggers if ALL check objects are non-compliant. Get that backwards and your prohibited-app rule silently never fires.

The article also covers the Observe/Warn/Restrict actions, Check and Remediation objects, and planning the rollout so you do not create a helpdesk storm. Everything is based on the official Harmony Endpoint Administration Guide (cloud / Infinity Portal).

Link: https://community.checkpoint.com/t5/Endpoint/EN-Compliance-Deep-Dive-Checks-Remediation-amp-the-Restrict/m-p/283674#M11683

Feedback and corrections welcome.