Create custom checks

[ Applies to ] StorageGuard 9.2 and later

When the knowledge base doesn't cover one of your requirements, write your own check. Describe it in plain language to the AI Assistant, which generates and tests the logic for you, or build it in the UI with your own detection script. Either way, the check lives in a custom check package and works like a built-in check once a policy includes it.

Choose how to build it

	AI Assistant	UI
You provide	A plain-language description, such as check that Single Sign-On is enabled.	The command or API output to use, and a detection script.
StorageGuard does	Finds the right API and data fields, writes the logic and the finding text, and simulates a run on your systems.	Runs your script against collected data.
Best for	Most checks, especially when you know what to verify but not how.	Precise control over the logic, or data from an expansion package.

Build a check with the AI Assistant

1. Open the AI Assistant and type create a custom check.
2. Enter the package name, the target platform, the check name, and a description of what the check should detect.
3. Click Submit. The assistant proposes the detection logic, summary, description, impact and remediation, and simulates a run against your existing systems.
4. Review the results, and confirm to enable the check.

For a full walkthrough, see Build custom checks with AI.

Build a check in the UI

Create a package

Custom checks are grouped in packages, for example one per team or per platform.

1. Go to Baseline Configuration > Checks > Custom checks.
2. Click +, enter the Package name, Author and Description, and click Save.

Create the check

3. Right-click the package and select Manage custom checks, then click +.
4. Enter the Custom check name, and select the Ease of Implementation and Severity.
5. Select the security principle, impact category and security labels. The labels decide which policies can include the check.
6. On the Input & Logic tab, select the System type, then the command whose output the check will evaluate.
7. To let users supply values, such as approved domain names or a maximum timeout, click + to add a parameter. Parameters then appear in check parameters.
8. Add the detection script.
9. On the Details tab, enter the Summary, Description and Impact that findings will show.
10. On the Resolution tab, describe how to fix the issue, including remediation commands or APIs, and select the remediation type.
11. Click Apply.

To build a check on data that StorageGuard doesn't collect by default, such as a configuration file, first add it with an expansion package. The steps are otherwise the same.

Test the check

Right-click the check and select Execute test to run it now against collected data, then fix the logic until the result is what you expect.

Add the check to a policy

A custom check only runs in an analysis if an enabled policy includes it. Either:

• Give the check a security label that an enabled policy already includes, or
• Add it to one of your policies under By checks > Included checks. See Create your own baseline policy.

Manage custom checks

Within a package, double-click a check to edit it. The right-click menu also lets you execute a test, activate or deactivate, clone, remove, and import checks.

Related articles

• Build custom checks with AI
• Extend collection with expansion packages (advanced)
• Create your own baseline policy