Home
Arc
Arc is a host-based sensor that detects and defends against malicious or compromised endpoints and insider attacks.
Configuration
Details on how to configure Arc.
Local UI
The default method to manage Arc is through the upstream Nozomi Networks product, which applies configurations to all Arc sensors in Service mode. However, it is also possible to manage Arc through a local UI for One-shot and Offline executions.
Compliance
The Compliance tab shows compliance information for the host on which Arc is running, across several tabs.
Policies
The Policies tab lists the policies configured on this Arc sensor.

Arc
Arc is a host-based sensor that detects and defends against malicious or compromised endpoints and insider attacks.
- Introduction
  An overview of Arc.
- Requirements
  The machine and network requirements necessary to use Arc.
- Preparation
  Information on how to import Arc packages, and install a license.
- Configuration
  Details on how to configure Arc.
  - Configure an Arc sensor in Guardian
    You can configure an individual Arc sensor in Guardian directly from the Sensors details page for the related sensor.
  - Configure an Arc sensor in Vantage
    You can configure an individual Arc sensor in Vantage directly from the Sensors details page for the related sensor. Arc sensors in Service mode use these settings.
  - Discovery and Smart Polling conditions
    The minimum conditions required to run Discovery and Smart Polling on Arc depend on the Arc deployment mode.
  - Local UI
    The default method to manage Arc is through the upstream Nozomi Networks product, which applies configurations to all Arc sensors in Service mode. However, it is also possible to manage Arc through a local UI for One-shot and Offline executions.
    - Configuration
      The Configuration page lets you define upstream connection settings, execution options, protection preferences, and traffic monitoring parameters for the Arc sensor.
    - Status
      The Status section shows a list of all the required dependencies for the selected sensor, and the installation status for each dependency.
    - Latest run
      The Latest run section shows the status and mode of the latest run that was executed.
    - Asset inventory
      The Asset inventory section displays the status of Discovery and Smart Polling. These features provide visibility into networked devices and asset details.
    - Last 100 runs
      The Last 100 runs section shows the status of the last 100 runs.
    - This asset
      The This asset tab displays information about the host on which Arc is running, across several tabs.
    - Alerts
      The Alerts page lists every alert that the sensor has generated.
    - Compliance
      The Compliance tab shows compliance information for the host on which Arc is running, across several tabs.
      - Why use Compliance
        Compliance runs standards-based hardening benchmarks against the host on which Arc is running, replacing one-off manual audits with auditable evidence of its security posture.
      - Benchmark management
        The Benchmark management tab lists the benchmarks available on this Arc sensor.
      - Policies
        The Policies tab lists the policies configured on this Arc sensor.
        Compliance policies
        A compliance policy groups one or more benchmarks together so you can run them as a single scan.
        Policy source
        The Source column on the Policies page shows how a policy was created.
      - Scan logs
        The Scan logs tab lists the compliance scans that have run on this Arc sensor.
    - Offline archives
      The Offline archives page shows a list of the offline archives created on the host.
    - Open the local UI
      The local UI lets you manage Arc without the use of a parent system software. It gives you access to the Status page to monitor the status of Arc executions, and the Configuration page to configure Arc executions. You can double-click the executable file to open it, or use the command-line interface (CLI).
  - Compliance scanning
    Arc is the sensor that Compliance scans run against. Compliance scans run only when they are requested from the upstream system that manages the sensor.
  - Shell commands
    A list of available shell commands.
- Deployment
  Information on how to deploy Arc. This includes details for manual and automatic deployments, and deployment through a mobile device management (MDM) system.
- Execution
  Information on the different modes that you can use with Arc.
- Troubleshooting
  Troubleshooting procedures to help you solve problems that might occur when you use Arc.

Policies

The Policies tab lists the policies configured on this Arc sensor.

For more details, see Compliance policies.

The Policies page is read-only: policies are created and managed from the upstream system, and each scan requested from upstream creates a policy on this sensor. The Policies page has no Schedules column. Instead, it has a Source column. For more details, see Policy source.

Column descriptions

The Rules, Updated, and Description columns are hidden until you enable them from the column panel.

Column label	Description
Policy name	The name of the policy.
Version	The current version number of the policy.
Benchmarks	The benchmarks included in the policy.
Rules	The number of rules in the policy, across all of its benchmarks.
Updated	When the policy was last updated.
Description	The description of the policy.
Source	Whether the policy was created locally (Local), or was created automatically by a scan requested from upstream (Remote).