---
title: "Create a policy from a node scan"
description: "Turn a known-good node's scan into a policy other nodes are checked against."
product: "Guardian"
edition: "Classic"
type: "workflow"
url: "https://docs.cloudhouse.com/guardian/classic/control/policies/create-policy-from-node-scan/"
---
# Create a policy from a node scan

Turn a known-good node's scan into a policy other nodes are checked against. For example, you could create a policy to ensure that a set of roles and features are installed on a node, or that certain environment variables are set. For more information on policies, see [Policies](https://docs.cloudhouse.com/guardian/classic/control/policies/policies/index.md).

Applies to: `Guardian Classic`

![Report no red border](https://docs.cloudhouse.com/guardian/classic/assets/images/guardian/inventory/monitored/node-groups/node-scan-report/report-no-red-border.png)

The term 'node' in Guardian is used to represent any scannable object in your environment. All monitored nodes are scanned on a regular basis, either according to a set schedule, or Guardian's default settings. There are a few reasons you may want to create a policy from a node scan. If a configuration item or attribute is behaving inconsistently between scans, you can define the correct configuration state by creating a policy from the desired node scan. The policy checks are then run each time the node is scanned, with the results indicating whether the checks passed or failed. You can use the policy results to better understand how your nodes are behaving. For example, you can create a policy to check that a specific user has a defined set of properties, or that the IP address of a node's server is being set correctly. There are a myriad of properties that Guardian can check during each scan.

To create a policy from a node scan, complete the following steps:

1. In the Guardian web application, navigate to the **Monitored** tab (**Inventory** > **Monitored**).

    ![Monitored tab](https://docs.cloudhouse.com/guardian/classic/assets/images/guardian/inventory/monitored/node-groups/edit-node-group/monitored-tab.png)

2. In the **Node Groups** drop-down menu, select the node that you want to access from the 'All Nodes' node group. The results of the node's most recent scan are displayed. For more information on this page, see [Node Scan Results](https://docs.cloudhouse.com/guardian/classic/inventory/monitored/nodes/node-scan-results/index.md).

    !!! note

        Each configuration item is represented by a square. Configuration items that already have a policy applied appear as red or green; the color indicating whether the policy passed or failed during the current scan.

    ![Report no red border](https://docs.cloudhouse.com/guardian/classic/assets/images/guardian/inventory/monitored/node-groups/node-scan-report/report-no-red-border.png)

    Here, you can add anything that is displayed on the node's scan results to a policy. Essentially anything that is displayed underneath the 'All' configuration type, such as individual configuration items (the squares), or overarching configuration types (such as 'Packages' or 'Files').

3. Right-click on the item you want to add to a policy. Several options are displayed.

    !!! tip

        Use the search bar to filter and group the items you want to add to a policy. Then, create a policy for each of the items returned by the search query by right-clicking on the 'All' configuration item. This way, you don't need to create individual policies for each item.

    ![Pre select](https://docs.cloudhouse.com/guardian/classic/assets/images/guardian/control/policies/create-policy/pre-select.png)

4. Hover your cursor over the **Add to Policy** option, then move your cursor to the node group you want the policy to validate, and then select **New Policy**. The **Build Policy** dialog is displayed.

    !!! note

        Alternatively, you can select an existing policy from the list to add the selected item's current configuration state as a series of checks to the existing policy.

    ![Node scan report](https://docs.cloudhouse.com/guardian/classic/assets/images/guardian/control/policies/create-policy/node-scan-report.png)

5. Enter a name for the policy in the field provided, then click **Build**.

    ![Build policy](https://docs.cloudhouse.com/guardian/classic/assets/images/guardian/control/policies/create-policy/build-policy.png)

The policy is created and applied to the node group you selected. The following confirmation message is displayed, 'Policy [name] is applied to [node group], affecting [X] nodes - Generate Report'. Click the 'Generate Report' hyperlink to generate a report detailing how many times the policy check has been run, passed, and failed on the affected nodes. For more information, see [Policy Reports](https://docs.cloudhouse.com/guardian/classic/reports/policy-reports/policy-reports/index.md).