--- title: "Get started with Security Compliance" description: "Turn on E2E Security Compliance for a Linux node, connect its Wazuh agent, and open the node's security dashboard in MyAccount." content_type: "get-started" product: "security-compliance" platform: "MyAccount" url: "/myaccount/security-compliance/get-started/" --- # Get started with Security Compliance Get a node's security agent reporting to Security Compliance, where it counts as an active agent and has its own dashboard of security events, vulnerabilities, and MITRE ATT&CK tactics. You need a running Linux node in Delhi that you can sign in to over SSH. Security Compliance covers Delhi nodes other than FortiGate nodes, nodes attached to a VPC with **Custom CIDR**, and nodes on the older Xen hypervisor. ## Turn on Security Compliance for the node 1. Open the node's actions. In the node list, open the node's **Actions** menu. On the node's own page, open **Actions**, then **Security**. 2. Click **Enable Security Compliance**. A dialog opens and shows the charge per node per month. 3. Turn on **I want to start Security Compliance for this Node**. 4. The node's monthly **Compliance License** starts when you click **Enable**, before the agent connects. E2E charges any part of a month as a whole month; for prices, see [E2E's pricing page](https://www.e2enetworks.com/pricing). Click **Enable**. The node is now registered with E2E's compliance server, and the same dialog shows the setup commands to run inside it. To turn Security Compliance off later, see [Enable Security Compliance on a node](/myaccount/node/how-to/enable-security-compliance/#turn-off-security-compliance). ## Run the setup commands inside the node The commands install the Wazuh agent 4.8.2 and point it at the compliance server. They name the agent after your node and give it this node's own registration key, so they work only on this node. The agent connects out from the node to E2E's compliance server on TCP ports 1514 and 1515. If a firewall inside the node limits outbound traffic, allow those two ports. 1. In the dialog, choose the tab that matches your distribution's package manager: **Yum package Manager**, **APT package Manager**, or **Zypp package manager**. 2. Sign in to the node over SSH. 3. Run the commands in the order shown. They remove any Wazuh agent installed before, add Wazuh's package signing key and repository, install and register the agent, and start it. 4. To keep routine package updates from upgrading the agent, run the last step too, which MyAccount marks as recommended. It turns Wazuh's repository off again, so the agent stays at the version you installed. 5. To check that the agent is running, run: ```bash systemctl status wazuh-agent ``` A running agent shows `active (running)`. 6. To check that the agent has connected to the server, read its log: ```bash tail -fn100 /var/ossec/logs/ossec.log ``` Once the agent has connected, the log shows a line with `Connected to the server`. The command keeps printing new lines as they arrive. Press Ctrl+C to stop it. 7. In the dialog, click **Close**. The **Security Compliance** page opens. If you close the dialog before you have copied the commands, open them again from the **commands** link on the node's page. ## Check that the agent is active The **Security Compliance** page shows four counts: **Total agents**, **Active agents**, **Disconnected agents**, and **Never connected agents**. Your node counts under **Never connected agents** until its agent connects, then under **Active agents**. The page reads the counts when it opens, so to see the latest, open **Security Compliance** from the side menu again. Once an agent is active, the page lists the six views under **Security Information Management**, **Threat Detection And Response**, and **Regulatory Compliance**. The node's own page now reads **Security Compliance is active on your Node.** If your node stays under **Never connected agents**, see [The agent shows as never connected](/myaccount/security-compliance/troubleshooting/security-compliance/#the-agent-shows-as-never-connected). ## Open your agent's dashboard 1. On the **Security Compliance** page, select the link beside **Active agents**. The agent list opens, with your node's name under **Agent name**. 2. Select your agent. Its dashboard opens, with **Security Events**, **Vulnerabilities**, and **MITRE ATT&CK** at the top, and **More ...** for the other views. The dashboard covers the last 90 days. To look at a shorter period, choose one under **Select Period**, such as **Last 24 Hour**. A chart with nothing to show for the period says its data is not found. ## What to do next - [Read the Security Compliance dashboard](/myaccount/security-compliance/how-to/read-the-security-compliance-dashboard/): filter and export security alerts, and find the vulnerable packages on a node. - [What Security Compliance checks](/myaccount/security-compliance/concepts/what-security-compliance-checks/): what each view reports, and how to change what the agent watches inside the node. - [Enable Security Compliance on a node](/myaccount/node/how-to/enable-security-compliance/#turn-off-security-compliance): turn it off for a node you no longer need to watch, which ends its charge.