SurePassID

Compliance Manager Quick Start Scenarios

SurePassID Documentation / Compliance Manager

SurePassID Compliance Manager Quick Start Scenarios

SurePassID Authentication Server

SurePassID Compliance Monitoring - Quick Start Scenarios

This guide provides copy-paste examples for common deployment scenarios.

Scenario 1: First-Time Setup (New!)

New users start here! The easiest way to get started without editing JSON.

Using the Interactive Wizard

# Run the setup wizard
compliance-cli configure

# Quick mode (required fields only)
compliance-cli configure --quick

# Save to specific location
compliance-cli configure --output C:\Services\ComplianceMonitor\appsettings.json

The wizard prompts you for:

  • Event source type (SurePassID API, JSON files, or Syslog)
  • SurePassID server URL and API credentials
  • Active Directory server and authentication
  • Privileged groups to monitor
  • Schedule for automated checks

Using PowerShell Script (Windows)

# Full interactive setup with service installation
.\scripts\Setup-ComplianceService.ps1

# Only generate configuration (no service install)
.\scripts\Setup-ComplianceService.ps1 -ConfigOnly

# Custom install location
.\scripts\Setup-ComplianceService.ps1 -InstallPath "D:\Apps\Compliance"

Using CLI After Configuration

# Run compliance check with your new config
compliance-cli run

# Run with evidence pack generation
compliance-cli run --evidence-pack

# Run with custom time range
compliance-cli run --lookback 48

Scenario 2: Basic Compliance Check (Console App)

Run a one-time compliance check against JSON log files.

using Microsoft.Extensions.DependencyInjection;
using Microsoft.Extensions.Logging;
using SurePassID.Compliance.Events.FileIngest;
using SurePassID.Compliance.Identity.ActiveDirectory;
using SurePassID.Compliance.Reporting;
using SurePassID.Compliance.Reporting.Export;
using SurePassID.Compliance.Runner;

// 1. Configure services
var services = new ServiceCollection();

services.AddLogging(b => b.AddConsole().SetMinimumLevel(LogLevel.Information));

// Point to your JSON log files
services.AddJsonFileEventSource(options =>
{
    options.DirectoryPath = @"C:\Logs\AuthEvents";
    options.FilePattern = "*.json";
    options.Format = JsonEventFormat.JsonFlat;
});

// Connect to Active Directory
services.AddActiveDirectoryIdentityProvider(options =>
{
    options.Server = "dc01.yourdomain.com";
    options.BaseDn = "DC=yourdomain,DC=com";
    options.UseIntegratedAuth = true; // Uses your Windows login
});

services.AddComplianceRunner();

// 2. Run compliance check
var provider = services.BuildServiceProvider();
var runner = provider.GetRequiredService<IComplianceRunner>();

var result = await runner.RunAsync(new ComplianceRunRequest
{
    Start = DateTimeOffset.UtcNow.AddDays(-7),
    End = DateTimeOffset.UtcNow,
    PrivilegedGroupNamesOrDns = ["Domain Admins", "Enterprise Admins"],
    Reports = [ReportType.PrivilegedAuthReport, ReportType.SfaMfaSummary]
});

// 3. Display results
Console.WriteLine($"\n=== Compliance Check Results ===");
Console.WriteLine($"Events Analyzed: {result.Summary.EventsIngested}");
Console.WriteLine($"Privileged Events: {result.Summary.PrivilegedEventCount}");
Console.WriteLine($"MFA Rate: {result.Summary.MfaPercentage:F1}%");
Console.WriteLine($"Compliant: {(result.Summary.SfaPercentage == 0 ? "YES" : "NO")}");

// 4. Export reports
var exporter = new ReportExporter();
var pdfExporter = new PdfReportExporter();

var exportOptions = new ReportExportOptions
{
    OutputDirectory = @"C:\ComplianceReports",
    FileNamePrefix = "Weekly",
    IncludeTimestamp = true
};

if (result.PrivilegedAuthReport != null)
{
    await exporter.ExportToJsonAsync(result.PrivilegedAuthReport, exportOptions, "PrivilegedAuth");
    await pdfExporter.ExportPrivilegedAuthReportAsync(result.PrivilegedAuthReport, exportOptions);
    Console.WriteLine("Reports exported to C:\\ComplianceReports");
}

Scenario 3: SurePassID REST API Integration

Connect directly to your SurePassID MFA server for real-time event streaming.

Quick Setup with CLI

# Configure SurePassID connection interactively
compliance-cli configure

# Or via command line
compliance-cli run \
    --config appsettings.json \
    --lookback 24 \
    --groups "Domain Admins" "Enterprise Admins"

Programmatic Setup

using Microsoft.Extensions.DependencyInjection;
using SurePassID.Compliance.Events.RestApi;
using SurePassID.Compliance.Identity.ActiveDirectory;
using SurePassID.Compliance.Runner;

var services = new ServiceCollection();

// Connect to SurePassID MFA server
services.AddSurePassIdRestApiEventSource(options =>
{
    options.Endpoint = "https://mfa.company.com/api/mfa/v1";
    options.ApiKeyId = "your-api-key-id";
    options.ApiKey = "your-api-key";
    options.UseHttpHeader = true;
    options.MaxEventsPerRequest = 1000;
    options.RetryCount = 3;

    // Re-read all events in the time range for complete compliance reports.
    // The server filters by startDateUtc/endDateUtc for efficient retrieval.
    options.IgnoreSyncStatus = true;

    // Request JSON bulk format for richer event data (AuthMethod, SsoIdentity,
    // UserEmail). Falls back to legacy piped format if the server is older.
    options.PreferJsonBulkFormat = true;
});

// Connect to Active Directory
services.AddActiveDirectoryIdentityProvider(options =>
{
    options.Server = "dc01.company.com";
    options.BaseDn = "DC=company,DC=com";
    options.UseIntegratedAuth = true;
});

services.AddComplianceRunner();

var provider = services.BuildServiceProvider();
var runner = provider.GetRequiredService<IComplianceRunner>();

// Run compliance check for last 24 hours
var result = await runner.RunAsync(new ComplianceRunRequest
{
    Start = DateTimeOffset.UtcNow.AddHours(-24),
    End = DateTimeOffset.UtcNow,
    PrivilegedGroupNamesOrDns = ["Domain Admins", "Enterprise Admins", "DBA Admins"],
    Reports = [ReportType.PrivilegedAuthReport, ReportType.SfaMfaSummary],
    IncludeEvidencePack = true
});

Console.WriteLine($"MFA Events: {result.PrivilegedAuthReport?.Summary.MfaEvents}");
Console.WriteLine($"SFA Events: {result.PrivilegedAuthReport?.Summary.SfaEvents}");
Console.WriteLine($"Compliant: {result.PrivilegedAuthReport?.Summary.SfaEvents == 0}");

Scenario 4: Windows Service Deployment

Deploy as a Windows Service for continuous monitoring.

Easy Setup with PowerShell

# Build the service
cd src\SurePassID.Compliance.Runner.Service
dotnet publish -c Release -o C:\Services\ComplianceMonitor

# Run the setup wizard
.\scripts\Setup-ComplianceService.ps1 -InstallPath C:\Services\ComplianceMonitor

Manual Setup

1. Build:

cd src\SurePassID.Compliance.Runner.Service
dotnet publish -c Release -o C:\Services\ComplianceMonitor

2. Configure (choose one method):

Option A - Use the wizard:

compliance-cli configure --output C:\Services\ComplianceMonitor\appsettings.json

Option B - Edit appsettings.json manually:

{
  "ComplianceService": {
    "Enabled": true,
    "CronSchedule": "0 2 * * *",
    "LookbackHours": 24,
    "PrivilegedGroups": ["Domain Admins", "Enterprise Admins"],
    "OutputDirectory": "C:\\ComplianceReports"
  },
  "EventSources": {
    "SurePassID": { "Enabled": true }
  },
  "SurePassID": {
    "Endpoint": "https://mfa.company.com/api/mfa/v1",
    "ApiKeyId": "compliance-api",
    "ApiKey": "your-api-key",
    "IgnoreSyncStatus": true,
    "PreferJsonBulkFormat": true
  },
  "ActiveDirectory": {
    "Server": "dc01.company.com",
    "BaseDn": "DC=company,DC=com",
    "UseIntegratedAuth": true
  }
}

3. Install and start:

sc.exe create "SurePassIDCompliance" `
    binPath="C:\Services\ComplianceMonitor\SurePassID.Compliance.Runner.Service.exe" `
    DisplayName="SurePassID Compliance Monitor" `
    start=auto

sc.exe start "SurePassIDCompliance"

Scenario 5: CLI for Cron Jobs / Automation

Use the CLI for scheduled or automated compliance checks.

Basic Usage

# Run with default settings (24-hour lookback)
compliance-cli run

# Custom time range
compliance-cli run --start "2024-01-15" --end "2024-01-16"

# Custom lookback
compliance-cli run --lookback 48

# Specific groups
compliance-cli run --groups "Domain Admins" "DBA Admins" "Healthcare IT"

# Generate evidence pack
compliance-cli run --evidence-pack --output ./reports

# Quiet mode (JSON output for automation)
compliance-cli run --quiet

Cron Job Example (Linux)

# Edit crontab
crontab -e

# Daily at 2 AM
0 2 * * * /opt/compliance-cli/compliance-cli run --quiet >> /var/log/compliance.log 2>&1

# Every 6 hours with evidence pack
0 */6 * * * /opt/compliance-cli/compliance-cli run -q --evidence-pack >> /var/log/compliance.log 2>&1

Windows Task Scheduler

$action = New-ScheduledTaskAction `
    -Execute "C:\Tools\compliance-cli.exe" `
    -Argument "run --quiet --config C:\Config\appsettings.json"

$trigger = New-ScheduledTaskTrigger -Daily -At 2:00AM

Register-ScheduledTask `
    -TaskName "ComplianceCheck" `
    -Action $action `
    -Trigger $trigger `
    -User "SYSTEM"

Parsing CLI Output in Scripts

# Get JSON output
result=$(compliance-cli run --quiet)

# Parse with jq
mfa_compliant=$(echo $result | jq -r '.mfaCompliant')
sfa_events=$(echo $result | jq -r '.sfaEvents')

if [ "$mfa_compliant" = "false" ]; then
    echo "WARNING: $sfa_events SFA events detected!"
    # Send alert...
fi

Scenario 6: HIPAA Compliance Reporting

Generate HIPAA Security Rule compliance reports for healthcare organizations.

using Microsoft.Extensions.DependencyInjection;
using SurePassID.Compliance.Events.RestApi;
using SurePassID.Compliance.Identity.ActiveDirectory;
using SurePassID.Compliance.Runner;
using SurePassID.Compliance.Reporting;
using SurePassID.Compliance.Reporting.Evidence;

var services = new ServiceCollection();

// Configure event source
services.AddSurePassIdRestApiEventSource(options =>
{
    options.Endpoint = "https://mfa.healthcare.local/api/mfa/v1";
    options.ApiKeyId = "hipaa-compliance-api";
    options.ApiKey = "your-api-key";
});

// Configure AD for healthcare privileged groups
services.AddActiveDirectoryIdentityProvider(options =>
{
    options.Server = "dc01.healthcare.local";
    options.BaseDn = "DC=healthcare,DC=local";
    options.UseIntegratedAuth = true;
});

services.AddComplianceRunner();

var provider = services.BuildServiceProvider();
var runner = provider.GetRequiredService<IComplianceRunner>();

// Run HIPAA-focused compliance check
var result = await runner.RunAsync(new ComplianceRunRequest
{
    Start = DateTimeOffset.UtcNow.AddDays(-30), // Monthly HIPAA reporting
    End = DateTimeOffset.UtcNow,
    PrivilegedGroupNamesOrDns = [
        "Domain Admins",
        "EHR Administrators",
        "Healthcare IT Staff",
        "Clinical System Admins"
    ],
    Reports = [
        ReportType.PrivilegedAuthReport,
        ReportType.SfaMfaSummary,
        ReportType.PrivilegeDriftSummary
    ],
    IncludeEvidencePack = true,
    ReportTitle = "HIPAA Security Rule - Authentication Compliance Report"
});

// Display HIPAA compliance summary
Console.WriteLine("\n=== HIPAA Security Rule Compliance Summary ===\n");

// §164.312(d) - Person or Entity Authentication
Console.WriteLine("§164.312(d) - Person or Entity Authentication:");
Console.WriteLine($"  MFA Adoption Rate: {result.SfaMfaSummaryReport?.Overall.MfaPercentage:F1}%");
Console.WriteLine($"  SFA Events: {result.SfaMfaSummaryReport?.Overall.SfaEvents}");
var mfaCompliant = result.SfaMfaSummaryReport?.Overall.SfaEvents == 0;
Console.WriteLine($"  Status: {(mfaCompliant ? "? COMPLIANT" : "? NON-COMPLIANT")}\n");

// §164.312(b) - Audit Controls
Console.WriteLine("§164.312(b) - Audit Controls:");
Console.WriteLine($"  Events Ingested: {result.Summary.EventsIngested}");
Console.WriteLine($"  Events Correlated: {result.Summary.EventsCorrelated}");
Console.WriteLine("  Status: ? AUDIT TRAIL ACTIVE\n");

// List SFA violations for remediation
if (!mfaCompliant && result.PrivilegedAuthReport != null)
{
    Console.WriteLine("--- Users Requiring MFA Remediation ---");
    foreach (var user in result.PrivilegedAuthReport.UserSummaries.Where(u => u.SfaEvents > 0))
    {
        Console.WriteLine($"  • {user.Username}: {user.SfaEvents} SFA events");
    }
}

Scenario 7: Configuration via Environment Variables

For Docker or CI/CD environments where secrets shouldn't be in config files.

Docker Compose Example

version: '3.8'
services:
  compliance-service:
    image: surepassid/compliance-monitor:latest
    environment:
      - ComplianceService__CronSchedule=0 2 * * *
      - ComplianceService__LookbackHours=24
      - EventSources__SurePassID__Enabled=true
      - SurePassID__Endpoint=https://mfa.company.com/api/mfa/v1
      - SurePassID__ApiKeyId=${SUREPASSID_API_KEY_ID}
      - SurePassID__ApiKey=${SUREPASSID_API_KEY}
      - ActiveDirectory__Server=dc01.company.com
      - ActiveDirectory__BaseDn=DC=company,DC=com
    volumes:
      - ./reports:/data/reports

Environment Variables Reference

# Event sources
export EventSources__SurePassID__Enabled="true"
export EventSources__WindowsEventLog__Enabled="true"
export EventSources__JsonFile__Enabled="false"

# SurePassID credentials
export SurePassID__Endpoint="https://mfa.company.com/api/mfa/v1"
export SurePassID__ApiKeyId="compliance-api"
export SurePassID__ApiKey="your-secret-key"
export SurePassID__IgnoreSyncStatus="true"
export SurePassID__PreferJsonBulkFormat="true"

# Active Directory
export ActiveDirectory__Server="dc01.company.com"
export ActiveDirectory__BaseDn="DC=company,DC=com"
export ActiveDirectory__UseIntegratedAuth="true"

# Schedule
export ComplianceService__CronSchedule="0 2 * * *"
export ComplianceService__LookbackHours="24"

Next Steps

  1. Run compliance-cli configure to set up your configuration
  2. Review docs/UserGuide.md for detailed API documentation
  3. Check docs/DeploymentGuide.md for deployment options
  4. Enable real-time monitoring for continuous compliance
  5. Set up scheduled reports for regular audits
  6. Configure alerts for immediate notification of violations

© 2013–2026 SurePassID. All rights reserved. Protected by patents pending. SurePassID, the SurePassID logo and design, and Secure SSO are registered trademarks or trademarks of SurePassID, Corp. in the United States and/or other jurisdictions. All other marks and names mentioned herein may be trademarks of their respective companies.

SurePassID 360 Central Avenue #800 St. Petersburg, FL 33701 USA +1 (888) 200-8144 surepassid.com