We used to run Ansible pull across 500+ servers to maintain a consistent image across all servers. It happens many times that a system administrator flushes iptables if things are not working or stops OSSEC if it blocks scans.
This leads to a lot of unexpected configurations everywhere, and during an audit period, OSSEC may be disabled in a few servers from the past few weeks.
So, our entire hardening stack was based on Ansible pull that used to run at midnight on all servers. If there were any configuration changes, then Ansible would update it back to the original consistent state.
This is extremely useful and makes the auditors smile as well.
