Home
Arc
Arc is a host-based sensor that detects and defends against malicious or compromised endpoints and insider attacks.
Configuration
Details on how to configure Arc.
Local UI
The default method to manage Arc is through the upstream Nozomi Networks product, which applies configurations to all Arc sensors in Service mode. However, it is also possible to manage Arc through a local UI for One-shot and Offline executions.
Compliance
The Compliance tab shows compliance information for the host on which Arc is running, across several tabs.
Benchmark management
The Benchmark management tab lists the benchmarks available on this Arc sensor.

Arc
Arc is a host-based sensor that detects and defends against malicious or compromised endpoints and insider attacks.
- Introduction
  An overview of Arc.
- Requirements
  The machine and network requirements necessary to use Arc.
- Preparation
  Information on how to import Arc packages, and install a license.
- Configuration
  Details on how to configure Arc.
  - Configure an Arc sensor in Guardian
    You can configure an individual Arc sensor in Guardian directly from the Sensors details page for the related sensor.
  - Configure an Arc sensor in Vantage
    You can configure an individual Arc sensor in Vantage directly from the Sensors details page for the related sensor. Arc sensors in Service mode use these settings.
  - Discovery and Smart Polling conditions
    The minimum conditions required to run Discovery and Smart Polling on Arc depend on the Arc deployment mode.
  - Local UI
    The default method to manage Arc is through the upstream Nozomi Networks product, which applies configurations to all Arc sensors in Service mode. However, it is also possible to manage Arc through a local UI for One-shot and Offline executions.
    - Configuration
      The Configuration page lets you define upstream connection settings, execution options, protection preferences, and traffic monitoring parameters for the Arc sensor.
    - Status
      The Status section shows a list of all the required dependencies for the selected sensor, and the installation status for each dependency.
    - Latest run
      The Latest run section shows the status and mode of the latest run that was executed.
    - Asset inventory
      The Asset inventory section displays the status of Discovery and Smart Polling. These features provide visibility into networked devices and asset details.
    - Last 100 runs
      The Last 100 runs section shows the status of the last 100 runs.
    - This asset
      The This asset tab displays information about the host on which Arc is running, across several tabs.
    - Alerts
      The Alerts page lists every alert that the sensor has generated.
    - Compliance
      The Compliance tab shows compliance information for the host on which Arc is running, across several tabs.
      - Why use Compliance
        Compliance runs standards-based hardening benchmarks against the host on which Arc is running, replacing one-off manual audits with auditable evidence of its security posture.
      - Benchmark management
        The Benchmark management tab lists the benchmarks available on this Arc sensor.
        Compliance benchmarks
        A compliance benchmark is a file that defines the checks used to assess whether a system meets a security standard such as SCAP or STIG.
      - Policies
        The Policies tab lists the policies configured on this Arc sensor.
      - Scan logs
        The Scan logs tab lists the compliance scans that have run on this Arc sensor.
    - Offline archives
      The Offline archives page shows a list of the offline archives created on the host.
    - Open the local UI
      The local UI lets you manage Arc without the use of a parent system software. It gives you access to the Status page to monitor the status of Arc executions, and the Configuration page to configure Arc executions. You can double-click the executable file to open it, or use the command-line interface (CLI).
  - Compliance scanning
    Arc is the sensor that Compliance scans run against. Compliance scans run only when they are requested from the upstream system that manages the sensor.
  - Shell commands
    A list of available shell commands.
- Deployment
  Information on how to deploy Arc. This includes details for manual and automatic deployments, and deployment through a mobile device management (MDM) system.
- Execution
  Information on the different modes that you can use with Arc.
- Troubleshooting
  Troubleshooting procedures to help you solve problems that might occur when you use Arc.

Benchmark management

The Benchmark management tab lists the benchmarks available on this Arc sensor.

Benchmark management tab in the Arc local UI, showing no benchmarks on this sensor and the disabled Upload button — Figure 1. Benchmark management page

For more details, see Compliance benchmarks.

The Benchmark management page is read-only: you cannot upload or delete benchmarks from Arc. Benchmarks are managed from the upstream system, and you can upload them only from Vantage. Arc stores benchmark files locally.

Column descriptions

The Rules, Published at, and Uploaded at columns are hidden by default.

Column label	Description
Benchmark name	The name of the benchmark.
Source	Which system provided the benchmark. In Vantage: provided by DISA (DISA) or uploaded by a user (Users). On Arc: uploaded on this sensor (Local) or fetched from the upstream system that manages this sensor (Remote).
Version	The version of the benchmark.
Category	The category of the benchmark, for example Operating System, Application, or Network Device.
Platform	The operating system (OS) family the benchmark applies to, for example Windows or Linux.
Rules	The number of rules in the benchmark.
Policies	The policies that use this benchmark. Select View JSON to see the full list.
Published at	The date the benchmark was published by its issuing body.
Uploaded at	When the benchmark was uploaded.
Uploaded by	The name of the user who uploaded the benchmark, or Update Service for Nozomi Networks-provided benchmarks. This column is shown in Vantage only; the Arc Benchmark management page does not include it.