Custom Baseline File Requirements

XML File

Use a valid XML file that has English language characters. The file can’t be larger than 20 KB. Make sure that each value is surrounded in quotation marks.

Custom Baseline Security Setting Fields and Values

You can’t add or delete the Health Check settings from the file, but you can change their risks and values.

There are four risk categories: High-Risk, Medium-Risk, Low-Risk, and Informational. The risk categories affect your Health Check score, with High-Risk settings counting the most, Low-Risk settings counting the least, and Medium-Risk settings in the middle. You can move settings into any risk category. Settings in the Informational category don’t factor into your Health Check score, so move unnecessary settings to this category rather than deleting them.

Each security setting shows in Health Check as compliant, warning, or critical. These statuses guide you to increase security. Assign values to each status in the import file.

There are three setting types: boolean, numeric range, and enum. The values that you can assign to each setting depend on the setting type.

Boolean Security Settings

Boolean settings have two attributes: compliant and noncompliant. Compliant values correspond to checkboxes in security settings. A Boolean value of “true” indicates selecting the checkbox, and “false” represents deselecting it. Noncompliant attributes can take either warning or critical values.

Important You can’t change boolean compliant values in Health Check, but you can change noncompliant values.

Numeric range values are positive integers extended to one decimal place. You provide compliant and warning values only for numeric range settings. Critical values are assumed based on the other values in the settings. Each setting has specific validation rules, so enter only acceptable values.

Enum values allow you to choose from provided string texts. Use all the possible values, and decide whether they’re compliant, warning, or critical status. Enum values are case sensitive. You can assign multiple enum names to one status by separating them with commas. For example, compliant="FifteenMinutes,ThirtyMinutes,SixtyMinutes,TwoHours".

To leave a status empty, use all values. For example, divide the values between compliant and critical and leave warning empty: warning=“”. Don't leave the compliant status empty.

Important Use every accepted value in each setting. If a value is missing, the file doesn’t import.