--- title: "Read the Security Compliance dashboard" description: "Read the E2E Security Compliance dashboard's agent counts, open an agent, choose the period, and use the six views to find, filter, and export alerts." content_type: "how-to" product: "security-compliance" platform: "MyAccount" url: "/myaccount/security-compliance/how-to/read-the-security-compliance-dashboard/" topic: ["monitor"] --- # Read the Security Compliance dashboard The **Security Compliance** page shows how many of your nodes are reporting. From it, you can open each agent's dashboard and the six views: **Security events**, **Integrity monitoring**, **Vulnerabilities**, **MITRE ATT&CK**, **PCI DSS**, and **HIPAA**. Use it to find the alerts that need attention, see which files changed and which packages are vulnerable, and export alerts as a CSV file. Turn on Security Compliance for at least one node and wait for its agent to connect. See [Get started with Security Compliance](/myaccount/security-compliance/get-started/). ## Open the Security Compliance page In the side menu, click **Security Compliance**. You can also search MyAccount for **Node security compliance**. The page opens on the agent counts. When no node in the selected project has Security Compliance on, the page says so. It links to the node list, where you turn it on for a node. ## Read the agent counts Each node with Security Compliance on is one agent. The page counts them four ways: - **Total agents**: every node with Security Compliance on. - **Active agents**: agents that are connected and reporting. - **Disconnected agents**: agents that connected before and have stopped reporting. - **Never connected agents**: nodes with Security Compliance on whose agent has not connected yet. The views show what active agents report. A disconnected or never connected agent adds nothing to them until it becomes active. The page reads the states from the compliance server each time it opens, so open the page again to see the latest states. To list the agents in one state, select the link beside its count. The links beside **Active agents** and **Never connected agents** are available when the count is above zero. When you have agents but none of them is active, the page shows the counts and a short guide in place of the views. To get an agent reporting, see [Troubleshooting Security Compliance](/myaccount/security-compliance/troubleshooting/security-compliance/). ## Use the agent list The agent list opens with a **Status** chart of **Active**, **Disconnected**, **Pending**, and **Never Connected** agents, and **Details** beside it. **Details** repeats the counts and adds **Pending agents**. It also names the **Most active agent**: the active agent with the most alerts over the last year. To list the agents in one state, select its count under **Details**. Each agent shows its **Agent Id**, **Agent name**, **IP Address**, **Operating System**, **Groups**, and **State**. The agent name is the node's name, and the IP address is the node's private IP. **State** shows one of three values: - An active agent reads **activated**. - An agent that has not connected yet reads **never_connected**. - Any other agent reads **deactivated**. To open an agent's dashboard, select an agent that has connected. An agent that has never connected offers **Start Connection** instead. **Start Connection** opens **Push Command** with the node's setup commands, on the same tabs as when you turned Security Compliance on. Run them inside that node. ## Open an agent's dashboard An agent's dashboard is a summary of one node. At the top, **Security Events**, **Vulnerabilities**, and **MITRE ATT&CK** open those views for this agent. **More ...** lists all six views, grouped under **Security information management**, **Threat detection and response**, and **Regulatory Compliance**, where HIPAA appears as **Hipaa**. Each opens with this agent selected. The dashboard also has two panels. **Mitre** lists the **Top Tactics** seen on the node, with a count for each; to see the techniques behind a tactic, select it. **Compliance** charts the node's alerts by requirement, for the standard you choose under **Version**: **PCI DSS** or **HIPAA**. When the node has no alerts for that standard, the panel reads **No results were found.** ## Choose the period and the agents **Select Period** sets the time the charts and lists cover. You can choose **Last Hour**, **Last 6 Hour**, **Last 12 Hour**, **Last 24 Hour**, **Last 1 Week**, or **Last 90 Days**. Each view with **Select Period** opens on **Last 90 Days**, the longest period the dashboard shows. To focus on recent events, choose a shorter one. In every view except **Vulnerabilities**, **Select Agent** chooses between **All Agent**, which covers every active agent in the project, and one active agent. A view opened from the **Security Compliance** page starts on **All Agent**; a view opened from an agent's dashboard starts on that agent. When a chart has nothing to show for the period and agents you chose, it shows a message such as **Top 5 agents data is not found.** To widen it, choose a longer period or **All Agent**. ## Work with security events **Security events** lists the security alerts your agents raised, such as failed logins. At the top are four counts: **Total**, **Level 12 or above alerts**, **Authentication failure**, and **Authentication success**. To narrow the **Security Alerts** list to one of them, select it. Start with the level 12 or above count: it holds the most serious events. With **All Agent**, the charts compare your agents, such as **Top 5 agents** and **Alerts evolution - Top 5 agents**. With one agent, they break its alerts down, such as **Top 5 alerts** and **Top 5 rule groups**. Each alert in **Security Alerts** shows its **Time**, **Agent**, **Agent Name**, **Technique(s)**, **Tactic(s)**, **Description**, **Level**, and **Rule ID**. Select a row to see every field of that alert. The list shows 5 alerts a page; choose 10, 20, 50, or 100 to see more at once. To find particular alerts: 1. In **Filter or Search**, enter any text, or choose a field, then **equals** or **not equals**, then a value. 2. To widen the list again, remove any filter, or click **Clear All** to remove them all. 3. To download the list, click **Export**. You get a CSV file of the alerts, with your filters and period applied. ## Look at file changes, vulnerabilities, and tactics **Integrity monitoring** shows the changes to files on your agents' nodes. **Files added**, **Files modified**, and **Files deleted** count them. Charts such as **Most active users** and **Alert by action over time** show who made the changes and when. Use the view to spot a change to a file you expect to stay the same. **Vulnerabilities** covers one agent at a time and always the last 90 days. Opened from the **Security Compliance** page, it starts on your first active agent; choose another under **Select Agent**. **Severity** counts the vulnerabilities as **Critical**, **High**, **Medium**, and **Low**, and selecting one narrows the **Vulnerabilities** list to it. Each entry describes the package and the vulnerability, with its **Vulnerability ID**, **Vulnerability Score Base**, and **Vulnerability Severity**. Start with **Critical**: those are the packages to update first. To download the list as a CSV file, click **Export**. **MITRE ATT&CK** sorts your security events by the attack tactics and techniques they match. Charts such as **Top Tactics**, **Attacks by technique**, and **Top tactics by agent** show which kinds of attack your nodes see most, and on which node. ## Check alerts against PCI DSS and HIPAA **PCI DSS** charts your alerts by the PCI DSS requirement they relate to. Its charts include **PCI DSS requirements**, **Requirements by agent**, and **Top 10 agents by alerts number**. **HIPAA** shows **Total alerts** and **Max rule level detected**, and charts your alerts by HIPAA requirement. Its charts include **Top 10 requirements**, **Requirements distribution by agent**, and **Most active agents**. Use them to see which requirements your alerts touch and which nodes raise them. To save alerts as a file, use **Export** in **Security events** or **Vulnerabilities**. For what each view reports, and how to change what the agent watches inside a node, see [What Security Compliance checks](/myaccount/security-compliance/concepts/what-security-compliance-checks/). If an agent stops reporting, see [Troubleshooting Security Compliance](/myaccount/security-compliance/troubleshooting/security-compliance/).