Read the Security Compliance dashboard

The Security Compliance page shows how many of your nodes are reporting. From it, you can open each agent’s dashboard and the six views: Security events, Integrity monitoring, Vulnerabilities, MITRE ATT&CK, PCI DSS, and HIPAA. Use it to find the alerts that need attention, see which files changed and which packages are vulnerable, and export alerts as a CSV file.

Turn on Security Compliance for at least one node and wait for its agent to connect. See Get started with Security Compliance.

Open the Security Compliance page

In the side menu, click Security Compliance. You can also search MyAccount for Node security compliance. The page opens on the agent counts.

When no node in the selected project has Security Compliance on, the page says so. It links to the node list, where you turn it on for a node.

Read the agent counts

Each node with Security Compliance on is one agent. The page counts them four ways:

• Total agents: every node with Security Compliance on.
• Active agents: agents that are connected and reporting.
• Disconnected agents: agents that connected before and have stopped reporting.
• Never connected agents: nodes with Security Compliance on whose agent has not connected yet.

The views show what active agents report. A disconnected or never connected agent adds nothing to them until it becomes active. The page reads the states from the compliance server each time it opens, so open the page again to see the latest states.

To list the agents in one state, select the link beside its count. The links beside Active agents and Never connected agents are available when the count is above zero.

When you have agents but none of them is active, the page shows the counts and a short guide in place of the views. To get an agent reporting, see Troubleshooting Security Compliance.

Use the agent list

The agent list opens with a Status chart of Active, Disconnected, Pending, and Never Connected agents, and Details beside it. Details repeats the counts and adds Pending agents. It also names the Most active agent: the active agent with the most alerts over the last year. To list the agents in one state, select its count under Details.

Each agent shows its Agent Id, Agent name, IP Address, Operating System, Groups, and State. The agent name is the node’s name, and the IP address is the node’s private IP. State shows one of three values:

• An active agent reads activated.
• An agent that has not connected yet reads never_connected.
• Any other agent reads deactivated.

To open an agent’s dashboard, select an agent that has connected. An agent that has never connected offers Start Connection instead. Start Connection opens Push Command with the node’s setup commands, on the same tabs as when you turned Security Compliance on. Run them inside that node.

Open an agent’s dashboard

An agent’s dashboard is a summary of one node. At the top, Security Events, Vulnerabilities, and MITRE ATT&CK open those views for this agent. More … lists all six views, grouped under Security information management, Threat detection and response, and Regulatory Compliance, where HIPAA appears as Hipaa. Each opens with this agent selected.

The dashboard also has two panels. Mitre lists the Top Tactics seen on the node, with a count for each; to see the techniques behind a tactic, select it. Compliance charts the node’s alerts by requirement, for the standard you choose under Version: PCI DSS or HIPAA. When the node has no alerts for that standard, the panel reads No results were found.

Choose the period and the agents

Select Period sets the time the charts and lists cover. You can choose Last Hour, Last 6 Hour, Last 12 Hour, Last 24 Hour, Last 1 Week, or Last 90 Days. Each view with Select Period opens on Last 90 Days, the longest period the dashboard shows. To focus on recent events, choose a shorter one.

In every view except Vulnerabilities, Select Agent chooses between All Agent, which covers every active agent in the project, and one active agent. A view opened from the Security Compliance page starts on All Agent; a view opened from an agent’s dashboard starts on that agent.

When a chart has nothing to show for the period and agents you chose, it shows a message such as Top 5 agents data is not found. To widen it, choose a longer period or All Agent.

Work with security events

Security events lists the security alerts your agents raised, such as failed logins. At the top are four counts: Total, Level 12 or above alerts, Authentication failure, and Authentication success. To narrow the Security Alerts list to one of them, select it. Start with the level 12 or above count: it holds the most serious events.

With All Agent, the charts compare your agents, such as Top 5 agents and Alerts evolution - Top 5 agents. With one agent, they break its alerts down, such as Top 5 alerts and Top 5 rule groups.

Each alert in Security Alerts shows its Time, Agent, Agent Name, Technique(s), Tactic(s), Description, Level, and Rule ID. Select a row to see every field of that alert. The list shows 5 alerts a page; choose 10, 20, 50, or 100 to see more at once.

To find particular alerts:

1. In Filter or Search, enter any text, or choose a field, then equals or not equals, then a value.
2. To widen the list again, remove any filter, or click Clear All to remove them all.
3. To download the list, click Export. You get a CSV file of the alerts, with your filters and period applied.

Look at file changes, vulnerabilities, and tactics

Integrity monitoring shows the changes to files on your agents’ nodes. Files added, Files modified, and Files deleted count them. Charts such as Most active users and Alert by action over time show who made the changes and when. Use the view to spot a change to a file you expect to stay the same.

Vulnerabilities covers one agent at a time and always the last 90 days. Opened from the Security Compliance page, it starts on your first active agent; choose another under Select Agent. Severity counts the vulnerabilities as Critical, High, Medium, and Low, and selecting one narrows the Vulnerabilities list to it. Each entry describes the package and the vulnerability, with its Vulnerability ID, Vulnerability Score Base, and Vulnerability Severity. Start with Critical: those are the packages to update first. To download the list as a CSV file, click Export.

MITRE ATT&CK sorts your security events by the attack tactics and techniques they match. Charts such as Top Tactics, Attacks by technique, and Top tactics by agent show which kinds of attack your nodes see most, and on which node.

Check alerts against PCI DSS and HIPAA

PCI DSS charts your alerts by the PCI DSS requirement they relate to. Its charts include PCI DSS requirements, Requirements by agent, and Top 10 agents by alerts number.

HIPAA shows Total alerts and Max rule level detected, and charts your alerts by HIPAA requirement. Its charts include Top 10 requirements, Requirements distribution by agent, and Most active agents.

Use them to see which requirements your alerts touch and which nodes raise them. To save alerts as a file, use Export in Security events or Vulnerabilities.

For what each view reports, and how to change what the agent watches inside a node, see What Security Compliance checks. If an agent stops reporting, see Troubleshooting Security Compliance.