E2E CloudSecurity Compliance FAQ
For help with an agent that is not reporting, or a charge you did not expect, see Troubleshooting Security Compliance.
Nodes and setup
Section titled “Nodes and setup”Which nodes can use Security Compliance?
Section titled “Which nodes can use Security Compliance?”Nodes in Delhi that run Linux or Windows. The exceptions are FortiGate nodes, nodes attached to a VPC with Custom CIDR, and nodes on the older Xen hypervisor. You turn it on for each node separately. See Enable Security Compliance on a node.
Can servers outside E2E, such as AWS or Azure machines, report to Security Compliance?
Section titled “Can servers outside E2E, such as AWS or Azure machines, report to Security Compliance?”No. You turn Security Compliance on for nodes in your MyAccount project, and only those nodes can report to it. See Security Compliance.
Can I turn on Security Compliance when I create a node?
Section titled “Can I turn on Security Compliance when I create a node?”No. Create the node first, then turn it on from the node’s actions. A node is charged for Security Compliance only after someone turns it on for that node. See Enable Security Compliance on a node.
Which operating systems do the setup commands cover?
Section titled “Which operating systems do the setup commands cover?”Linux and Windows. Linux commands come in three tabs: Yum package Manager, APT package Manager, and Zypp package manager. Use the one that matches your distribution’s package manager. Windows commands are on one tab, CMD. See Get started with Security Compliance.
Can I run the same setup commands on several nodes?
Section titled “Can I run the same setup commands on several nodes?”No. The commands carry one node’s own registration key, so they work only on that node. Turn Security Compliance on for each node and run that node’s commands inside it. See Enable Security Compliance on a node.
Where do I find the setup commands again?
Section titled “Where do I find the setup commands again?”On the node’s page, the warning shown until the agent connects has a commands link. On the agent list, an agent that has never connected offers Start Connection, which opens Push Command with the setup commands. See Use the agent list.
Will routine package updates upgrade the Wazuh agent?
Section titled “Will routine package updates upgrade the Wazuh agent?”No, as long as you run the last setup step, which MyAccount marks as recommended. It turns Wazuh’s package repository off again after the install, so the agent stays at version 4.8.2 on Linux. See Get started with Security Compliance.
Billing
Section titled “Billing”Is Security Compliance charged?
Section titled “Is Security Compliance charged?”Yes. E2E bills each node with Security Compliance on as its own Compliance License line, at a monthly rate per node. E2E charges any part of a billing month as the whole month. The enable dialog shows the charge, in rupees for an account paying in INR and in US dollars for any other account. For prices, see E2E’s pricing page.
When does the charge start and stop?
Section titled “When does the charge start and stop?”It starts when you click Enable, before the agent connects. It stops when you turn Security Compliance off for the node or delete the node, and the month it stops in is charged in full. See Enable Security Compliance on a node.
How do I find out who turned on Security Compliance for a node?
Section titled “How do I find out who turned on Security Compliance for a node?”Look in the audit log. Turning it on is recorded as Enable Node Compliance, and turning it off as Disable Node Compliance. See Read the audit log.
Turning it off
Section titled “Turning it off”What happens when I turn off Security Compliance?
Section titled “What happens when I turn off Security Compliance?”E2E removes the node’s agent from the compliance server and ends the node’s charge. The node also drops out of the agent counts and the views. The node keeps running, and the agent software stays installed inside it; remove it yourself if you no longer need it. See Enable Security Compliance on a node.
Can I turn Security Compliance on again for the same node?
Section titled “Can I turn Security Compliance on again for the same node?”Yes. The node is registered again with a new key, so the commands from the first time no longer work. Run the new commands the enable dialog shows. See Enable Security Compliance on a node.
What happens to Security Compliance when I delete a node?
Section titled “What happens to Security Compliance when I delete a node?”Deleting the node from MyAccount also removes its agent from the compliance server and ends its Security Compliance charge. The delete dialog warns that the node’s compliance data will be lost. See Delete a node.
The dashboard
Section titled “The dashboard”How far back can I look on the dashboard?
Section titled “How far back can I look on the dashboard?”Up to 90 days. Select Period goes from Last Hour to Last 90 Days, and the views open on Last 90 Days. See Read the Security Compliance dashboard.
Where do I see which packages need updating?
Section titled “Where do I see which packages need updating?”In Vulnerabilities. It lists the vulnerable packages on one node at a time, by severity, with each vulnerability’s ID and score. See Look at file changes, vulnerabilities, and tactics.
Can I export the alerts?
Section titled “Can I export the alerts?”Yes, from two views. Export in Security events downloads the alert list as a CSV file, and Export in Vulnerabilities does the same for the vulnerability list. Both apply your filters and period. See Work with security events.
Does Security Compliance check my servers’ configuration against a hardening policy?
Section titled “Does Security Compliance check my servers’ configuration against a hardening policy?”No. The dashboard reports security events, file changes, vulnerabilities, and alerts mapped to MITRE ATT&CK, PCI DSS, and HIPAA. It has no view of policy or hardening checks for a node’s operating system. See What Security Compliance checks.
Can I add custom rules or change the compliance server’s settings?
Section titled “Can I add custom rules or change the compliance server’s settings?”Not in MyAccount. E2E runs the compliance server, with its shared agent configuration, rules, and decoders. You can change what the agent watches in its own configuration on your node. See What you can change inside the node.
Does Security Compliance include ClamAV?
Section titled “Does Security Compliance include ClamAV?”No. Security Compliance neither installs ClamAV antivirus nor reports on it. You can install and run it on a node yourself, as you would any other software.