In the Detection screen, the Detection score focuses on the incoming activity of Armor services. You can use these scores to determine if Armor is receiving the necessary data to perform useful security checks for your environment.
For Armor Anywhere, these services are:
- Malware Protection
- FIM
- IDS
- Filebeat (for Linux)
- Winlogbeat (for Windows)
- Vulnerability Scanning
...
Widget
...
Description
...
Detection Score
...
This widget calculates a score based on:
- Armor services that are collecting logs
- Agents that are powered on
Score range | Health status |
|---|---|
| 10 - 8 | Good |
| 7 - 4 | Fair |
| 3 - 1 | Poor |
...
Events Analyzed
...
An event is any log that passes an Armor agent.
Malware Protection, File Integrity Monitoring, and Log and Event Management contain a subagent.
This widget displays data from the previous month.
...
Services Reporting
...
Detection Score Trend
...
The Detection Events table displays information for the past seven days. This table will update every day.
...
Column
...
Description
...
The Highest Risk Assets table displays virtual machines that contain the installed Armor Anywhere agent that are considered highly vulnerable. This table is based on the findings of the weekly vulnerability scanning report.
...
The Top Vulnerabilities table displays the most critical vulnerabilities found in your environment. This table is based on the findings of the weekly vulnerability scanning report.
...
Vulnerability Name
...
This column displays the name of the vulnerability.
| Note |
|---|
| You can click the Vulnerability Name to learn more about the vulnerability. You will be taken to a description page where you can review a description of the vulnerability, including the solution. |
...
Affected Assets
...
This column displays the virtual machines (host / asset) affected by the vulnerability.
| Note |
|---|
If you are unfamiliar with the name of a virtual machine, you can use the Virtual Machines screen to search.
|
...
Date Discovered
...
This column displays the date the vulnerability was discovered.
- This date will correspond with the date of the scan.
...
CVSS
...
This column displays the CVSS, a score attached to a vulnerability to determine the vulnerability's severity.
- To learn more, please see the National Vulnerability Database website.
...
Severity
...
This column displays the severity of the vulnerability.
There are four severity types, based on the vulnerability's CVSS:
- Critical
- Critical vulnerabilities receive a score of 10.
- High
- High vulnerabilities receive a score of 7-10.
- Medium
- Medium vulnerabilities receive a score of 4-7.
- Low
- Low vulnerabilities receive a score of 0-4.
| Note |
|---|
There is an additional severity type called Info. Although Info is listed as a severity type, in reality, Info simply displays activity information for corresponding plugins from third-party vendors. |
...
- In the Armor Management Portal (AMP), in the left-side navigation, click Detection.
- Under the Top Vulnerabilities table, click a specific vulnerability type.
- This action will take you the Vulnerability Scanning details screen where you can view a description of the vulnerability and the affected virtual machine.
...