SurePassID

Compliance Manager Deployment Guide

SurePassID Documentation / Compliance Manager

SurePassID Compliance Manager Deployment Guide

SurePassID Authentication Server

SurePassID Compliance Monitoring - Deployment Guide

Deployment Options

This solution supports multiple deployment scenarios:

Deployment Use Case Project/Directory
Windows Service 24/7 scheduled compliance checks Runner.Service
Linux Daemon systemd-based scheduled checks Runner.Service
Docker Container Containerized deployment docker/
Kubernetes Cloud-native orchestration docker/
Cron Job / Task Scheduler Periodic compliance checks Compliance.Cli
CLI / Scripts On-demand checks, automation Compliance.Cli
AI Agent Integration GitHub Copilot, MCP, OpenAI tools Agent.Tools
Real-time Monitoring Streaming alerts, webhooks Monitoring
Console Demo Testing and development TestApp

Quick Setup Options

Choose the method that best fits your comfort level:

Method Skill Level Best For
Interactive Wizard (CLI) Beginner First-time setup, learning the system
PowerShell Script Beginner Windows Service deployment
Template Config File Intermediate Customizing with inline guidance
Manual JSON Editing Advanced Full control over all settings

Easy Setup: Interactive Configuration Wizard

New! The easiest way to configure the compliance service - no JSON editing required.

Option A: CLI Setup Wizard

# Run the interactive setup wizard
compliance-cli configure

# Quick mode - only prompts for required settings
compliance-cli configure --quick

# Save to a custom location
compliance-cli configure --output C:\Services\ComplianceMonitor\appsettings.json

# Test configuration after saving
compliance-cli configure --test

The wizard guides you through:

  1. Event Source Selection (multiple sources supported)

    • SurePassID REST API (recommended)
    • Windows Event Log (AD login events)
    • JSON Files (SIEM exports)
    • Syslog Files
    • Entra ID (Azure AD)

  2. SurePassID Configuration (if using REST API)

    • Server URL
    • API Key ID
    • API Key (masked input)

  3. Windows Event Log Configuration (if enabled)

    • Log name (Security)
    • Remote computer (optional)
    • Event filters

  4. Active Directory Configuration

    • Server hostname
    • Base DN
    • Authentication method

  5. Privileged Groups

    • Which AD groups to monitor

  6. Schedule Configuration

    • Common presets (daily, every 6 hours, hourly)
    • Custom cron expressions

Sample Wizard Session:

===============================================================
  SurePassID Compliance Service - Configuration Wizard
===============================================================

This wizard will help you configure the compliance service.
Press Enter to accept default values shown in [brackets].

--- Step 1: Event Source --------------------------------------

Where should authentication events be read from?

  1. SurePassID REST API  (recommended - real-time MFA events)
  2. JSON Files           (import from exported files)
  3. Syslog Files         (Linux/Unix authentication logs)

Select event source [1]: 1

--- SurePassID Server Configuration ---------------------------

SurePassID Server URL: https://mfa.company.com/api/mfa/v1
API Key ID (Account Login Name): compliance-api
API Key (Account Login Key): ********

--- Step 2: Active Directory ----------------------------------

AD Server (hostname or IP) [dc01]: dc01.company.com
Base DN (e.g., DC=yourdomain,DC=com): DC=company,DC=com
Use Windows integrated authentication? [Y/n]: Y

--- Step 3: Privileged Groups ---------------------------------

Privileged groups [Domain Admins, Enterprise Admins]: Domain Admins, Enterprise Admins, DBA Admins

===============================================================
  Configuration Summary
===============================================================

  Event Source:      SurePassIdRestApi
  SurePassID Server: https://mfa.company.com/api/mfa/v1
  AD Server:         dc01.company.com
  Privileged Groups: Domain Admins, Enterprise Admins, DBA Admins
  Schedule:          0 2 * * *

Save configuration to 'appsettings.json'? [Y/n]: Y

[OK] Configuration saved to: C:\Services\ComplianceMonitor\appsettings.json

Option B: PowerShell Setup Script (Windows)

For Windows Service deployment, use the included PowerShell script:

# Interactive setup with service installation
.\scripts\Setup-ComplianceService.ps1

# Custom install location
.\scripts\Setup-ComplianceService.ps1 -InstallPath "D:\Apps\Compliance"

# Only generate config file (don't install service)
.\scripts\Setup-ComplianceService.ps1 -ConfigOnly

# Uninstall existing service
.\scripts\Setup-ComplianceService.ps1 -Uninstall

Features:

  • Auto-detects current domain and domain controller
  • Creates required directories
  • Saves configuration file
  • Installs and starts Windows Service
  • Configures service account

Option C: Template Configuration File

Copy and edit the commented template:

# Copy the template with inline documentation
copy src\SurePassID.Compliance.Cli\appsettings.template.jsonc appsettings.json

# Edit with any text editor - comments explain each setting
notepad appsettings.json

The template includes:

  • Inline comments explaining every setting
  • Common examples (cron schedules, DN formats)
  • Guidance for troubleshooting

1. Windows Service Deployment

# Build the service
cd src\SurePassID.Compliance.Runner.Service
dotnet publish -c Release -o C:\Services\ComplianceMonitor

# Run the setup wizard
.\scripts\Setup-ComplianceService.ps1 -InstallPath C:\Services\ComplianceMonitor

Method 2: Manual Installation

Build

cd src\SurePassID.Compliance.Runner.Service
dotnet publish -c Release -o C:\Services\ComplianceMonitor

Configure

Option A: Use the interactive wizard

compliance-cli configure --output C:\Services\ComplianceMonitor\appsettings.json

Option B: Edit appsettings.json manually

Edit C:\Services\ComplianceMonitor\appsettings.json:

{
  "ComplianceService": {
    "Enabled": true,
    "CronSchedule": "0 2 * * *",
    "TimeZone": "America/New_York",
    "RunOnStartup": false,
    "LookbackHours": 24,
    "PrivilegedGroups": [
      "Domain Admins",
      "Enterprise Admins"
    ],
    "OutputDirectory": "C:\\ComplianceReports",
    "RetentionDays": 90
  },
  "EventSources": {
    "JsonFile": {
      "Enabled": true,
      "DirectoryPath": "C:\\Logs\\AuthEvents",
      "FilePattern": "*.json"
    }
  },
  "ActiveDirectory": {
    "Server": "dc01.yourdomain.com",
    "BaseDn": "DC=yourdomain,DC=com",
    "UseIntegratedAuth": true
  }
}

Using SurePassID REST API Event Source:

{
  "ComplianceService": {
    "Enabled": true,
    "CronSchedule": "*/15 * * * *",
    "LookbackHours": 1,
    "PrivilegedGroups": ["Domain Admins", "Enterprise Admins"],
    "OutputDirectory": "C:\\ComplianceReports"
  },
  "EventSources": {
    "SurePassID": { "Enabled": true }
  },
  "SurePassID": {
    "Endpoint": "https://mfa.yourdomain.com/api/mfa/v1",
    "ApiKeyId": "compliance-api-account",
    "ApiKey": "your-api-key",
    "UseHttpHeader": true,
    "MaxEventsPerRequest": 1000,
    "IgnoreSyncStatus": true,
    "PreferJsonBulkFormat": true
  },
  "ActiveDirectory": {
    "Server": "dc01.yourdomain.com",
    "BaseDn": "DC=yourdomain,DC=com",
    "UseIntegratedAuth": true
  }
}

Using SurePassID + Windows Event Log (Multi-Source):

{
  "ComplianceService": {
    "Enabled": true,
    "CronSchedule": "0 2 * * *",
    "LookbackHours": 24,
    "PrivilegedGroups": ["Domain Admins", "Enterprise Admins"],
    "OutputDirectory": "C:\\ComplianceReports"
  },
  "EventSources": {
    "SurePassID": { "Enabled": true },
    "WindowsEventLog": { "Enabled": true }
  },
  "SurePassID": {
    "Endpoint": "https://mfa.yourdomain.com/api/mfa/v1",
    "ApiKeyId": "compliance-api-account",
    "ApiKey": "your-api-key",
    "IgnoreSyncStatus": true,
    "PreferJsonBulkFormat": true
  },
  "WindowsEventLog": {
    "LogName": "Security",
    "IncludeSuccessfulLogons": true,
    "IncludeFailedLogons": true,
    "ExcludeMachineAccounts": true,
    "ExcludeSystemAccounts": true,
    "MaxEventsPerQuery": 10000
  },
  "ActiveDirectory": {
    "Server": "dc01.yourdomain.com",
    "BaseDn": "DC=yourdomain,DC=com",
    "UseIntegratedAuth": true
  }
}

Install Service

# Create service
sc.exe create "SurePassIDCompliance" `
    binPath="C:\Services\ComplianceMonitor\SurePassID.Compliance.Runner.Service.exe" `
    DisplayName="SurePassID Compliance Monitor" `
    start=auto

# Configure service account (recommended: use a service account with AD read access)
sc.exe config "SurePassIDCompliance" obj="DOMAIN\svc_compliance" password="YourPassword"

# Start service
sc.exe start "SurePassIDCompliance"

# View status
sc.exe query "SurePassIDCompliance"

Uninstall

sc.exe stop "SurePassIDCompliance"
sc.exe delete "SurePassIDCompliance"

2. Linux Daemon (systemd)

Build

cd src/SurePassID.Compliance.Runner.Service
dotnet publish -c Release -r linux-x64 --self-contained -o /opt/compliance-monitor

Configure

# Use the CLI wizard
./compliance-cli configure --output /opt/compliance-monitor/appsettings.json

# Or edit manually
nano /opt/compliance-monitor/appsettings.json

Create systemd Unit

sudo nano /etc/systemd/system/compliance-monitor.service
[Unit]
Description=SurePassID Compliance Monitor
After=network.target

[Service]
Type=notify
WorkingDirectory=/opt/compliance-monitor
ExecStart=/opt/compliance-monitor/SurePassID.Compliance.Runner.Service
Restart=always
RestartSec=10
User=compliance
Group=compliance

# Environment
Environment=DOTNET_ENVIRONMENT=Production

[Install]
WantedBy=multi-user.target

Enable and Start

sudo systemctl daemon-reload
sudo systemctl enable compliance-monitor
sudo systemctl start compliance-monitor
sudo systemctl status compliance-monitor

# View logs
sudo journalctl -u compliance-monitor -f

3. CLI Tool Deployment

Build CLI

cd src/SurePassID.Compliance.Cli
dotnet publish -c Release -o /opt/compliance-cli

Configure

# Interactive setup
./compliance-cli configure

# Or with quick mode
./compliance-cli configure --quick

Usage

# Run compliance check
./compliance-cli run

# With specific options
./compliance-cli run --lookback 24 --groups "Domain Admins" "Enterprise Admins"

# Generate evidence pack
./compliance-cli run --evidence-pack --output ./reports

# Quiet mode for cron (JSON output)
./compliance-cli run --quiet

Cron Job Setup

# Edit crontab
crontab -e

# Daily at 2 AM
0 2 * * * /opt/compliance-cli/compliance-cli run --quiet --config /etc/compliance/config.json >> /var/log/compliance.log 2>&1

# Every 6 hours
0 */6 * * * /opt/compliance-cli/compliance-cli run -q -l 6 >> /var/log/compliance.log 2>&1

Windows Task Scheduler

# Create scheduled task
$action = New-ScheduledTaskAction -Execute "C:\Tools\compliance-cli.exe" `
    -Argument "run --quiet --config C:\Config\compliance.json" `
    -WorkingDirectory "C:\Tools"

$trigger = New-ScheduledTaskTrigger -Daily -At 2:00AM

$principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount

Register-ScheduledTask -TaskName "ComplianceCheck" `
    -Action $action -Trigger $trigger -Principal $principal `
    -Description "Daily CMMC/HIPAA compliance check"

4. Docker Deployment

See docker/README.md for complete Docker documentation.

Quick Start

cd docker

# Copy environment config
cp .env.example .env

# Start the service
docker-compose up -d compliance-service

# View logs
docker-compose logs -f

Available Containers

Container Purpose Command
compliance-service Background service with cron docker-compose up -d
compliance-cli On-demand checks docker-compose run compliance-cli run
compliance-cron Alternative cron runner docker-compose --profile cron up -d

Docker Compose

version: '3.8'
services:
  compliance-service:
    build:
      context: ..
      dockerfile: docker/Dockerfile.service
    environment:
      - ComplianceService__CronSchedule=0 2 * * *
      - ComplianceService__LookbackHours=24
      - ActiveDirectory__Server=dc01.domain.com
      - ActiveDirectory__BaseDn=DC=domain,DC=com
    volumes:
      - ./events:/data/events:ro
      - ./reports:/data/reports
    restart: unless-stopped

Production Deployment

# With resource limits and secrets
docker-compose -f docker-compose.yml -f docker-compose.prod.yml up -d

5. AI Agent Integration (MCP Server)

The solution includes a pre-built MCP server (src/SurePassID.Compliance.McpServer) that exposes all compliance tools to GitHub Copilot, Claude Desktop, Cursor, and any MCP-compatible client.

The MCP server supports the same multi-source event configuration, Windows Event Log ingestion, and MFA coverage correlation as the CLI and Service. Configure it via appsettings.json (or appsettings.template.jsonc) using the EventSources, SurePassID, WindowsEventLog, ActiveDirectory, and MfaCoverage sections.

Build

dotnet build src/SurePassID.Compliance.McpServer

# For deployment to another machine:
dotnet publish src/SurePassID.Compliance.McpServer -c Release -o ./publish

Register with GitHub Copilot (VS Code)

A .vscode/mcp.json is included in the repository. Edit the environment variables with your credentials, then open Copilot Chat -- the tools appear automatically.

Register with Visual Studio

Create .vs/mcp.json (same format as .vscode/mcp.json). See the AI Agent Integration Guide for the full JSON.

Register with Claude Desktop

Publish the server and point claude_desktop_config.json at the published executable. See the AI Agent Integration Guide for details.

Available Tools

Tool Description
run_compliance_check Run a full CMMC/HIPAA compliance check
get_compliance_status Get current status without full check
list_privileged_users List members of privileged groups
get_user_auth_history Get auth history for a specific user
get_sfa_violations List all SFA violations for privileged users
get_privilege_drift Detect changes in privileged group membership
generate_compliance_report Generate formal audit reports
acknowledge_alert Acknowledge a compliance alert
get_monitoring_statistics Get real-time monitoring stats

For additional integration methods (OpenAI Function Calling, Semantic Kernel, LangChain, CLI pipe, custom .NET host), see the AI Agent Integration Guide.

6. Real-time Monitoring

The SurePassID.Compliance.Monitoring project provides real-time event streaming and alerting.

Features

  • Event Streaming: Process events in real-time via channels
  • Alert Generation: Automatic alerts for:
    • Privileged user SFA (single-factor authentication)
    • Brute force attacks
    • After-hours authentication
    • Suspicious IP addresses
  • Notifications: Email and webhook notifications
  • Statistics: Sliding window statistics and Prometheus metrics

Enable Monitoring in Service

{
  "Monitoring": {
    "Enabled": true,
    "PollingIntervalSeconds": 30,
    "PrivilegeCacheRefreshMinutes": 5,
    "AlertRules": {
      "AlertOnPrivilegedSfa": true,
      "AlertOnBruteForce": true,
      "BruteForceThreshold": 5,
      "AlertOnAfterHoursAuth": true,
      "BusinessHoursStart": "08:00",
      "BusinessHoursEnd": "18:00"
    },
    "Webhook": {
      "Enabled": true,
      "Url": "https://your-siem.com/api/alerts",
      "MinimumSeverity": "Warning"
    },
    "Email": {
      "Enabled": true,
      "SmtpServer": "smtp.office365.com",
      "Recipients": ["security-team@contoso.com"],
      "MinimumSeverity": "High"
    }
  }
}

Alert Severity Levels

Level Description Use Case
Info Informational Logging only
Warning Should be reviewed SFA by non-privileged user
High Requires attention SFA by privileged user
Critical Immediate action Brute force, compromise indicators

Configuration Reference

Configuration Methods Summary

Method Command/File Use Case
Interactive Wizard compliance-cli configure New users, quick setup
PowerShell Script Setup-ComplianceService.ps1 Windows Service deployment
Template File appsettings.template.jsonc Guided manual editing
Environment Variables COMPLIANCE_* or Section__Key Docker, CI/CD
JSON Config appsettings.json Full control

Cron Schedule Examples

Schedule Cron Expression
Daily at 2 AM 0 2 * * *
Every 6 hours 0 */6 * * *
Weekdays at 6 AM 0 6 * * 1-5
First day of month 0 0 1 * *
Every 15 minutes */15 * * * *

Environment Variable Overrides

All settings can be overridden with environment variables using __ as separator:

export ComplianceService__CronSchedule="0 3 * * *"
export ActiveDirectory__Server="dc02.domain.com"
export EventSources__SurePassID__Enabled="true"
export EventSources__WindowsEventLog__Enabled="true"
export SurePassID__Endpoint="https://mfa.company.com/api/mfa/v1"
export SurePassID__ApiKeyId="compliance-api"
export SurePassID__ApiKey="your-secret-key"

Troubleshooting

Configuration Issues

# Test your configuration
compliance-cli configure --test

# Validate JSON syntax
cat appsettings.json | python -m json.tool

Service Won't Start

# Check Windows Event Log
Get-EventLog -LogName Application -Source "SurePassID*" -Newest 10

# Check service status
sc.exe query "SurePassIDCompliance"

No Events Found

  1. Verify event source path exists
  2. Check file pattern matches files
  3. Verify time range includes events
  4. Enable verbose logging: --verbose

AD Connection Issues

  1. Verify server is reachable: Test-NetConnection dc01 -Port 389
  2. Check credentials/permissions
  3. Try with explicit credentials instead of integrated auth

SurePassID API Issues

  1. Verify endpoint URL is correct
  2. Check API credentials are valid
  3. Enable tracing for debugging: 
    {
  "SurePassID": {
    "EnableTracing": true
  }
}

For Support

© 2013–2026 SurePassID. All rights reserved. Protected by patents pending. SurePassID, the SurePassID logo and design, and Secure SSO are registered trademarks or trademarks of SurePassID, Corp. in the United States and/or other jurisdictions. All other marks and names mentioned herein may be trademarks of their respective companies.

SurePassID 360 Central Avenue #800 St. Petersburg, FL 33701 USA +1 (888) 200-8144 surepassid.com