Home
Arc
Arc is a host-based sensor that detects and defends against malicious or compromised endpoints and insider attacks.
Configuration
Details on how to configure Arc.
Local UI
The default method to manage Arc is through the upstream Nozomi Networks product, which applies configurations to all Arc sensors in Service mode. However, it is also possible to manage Arc through a local UI for One-shot and Offline executions.
Compliance
The Compliance tab shows compliance information for the host on which Arc is running, across several tabs.
Scan logs
The Scan logs tab lists the compliance scans that have run on this Arc sensor.

Arc
Arc is a host-based sensor that detects and defends against malicious or compromised endpoints and insider attacks.
- Introduction
  An overview of Arc.
- Requirements
  The machine and network requirements necessary to use Arc.
- Preparation
  Information on how to import Arc packages, and install a license.
- Configuration
  Details on how to configure Arc.
  - Configure an Arc sensor in Guardian
    You can configure an individual Arc sensor in Guardian directly from the Sensors details page for the related sensor.
  - Configure an Arc sensor in Vantage
    You can configure an individual Arc sensor in Vantage directly from the Sensors details page for the related sensor. Arc sensors in Service mode use these settings.
  - Discovery and Smart Polling conditions
    The minimum conditions required to run Discovery and Smart Polling on Arc depend on the Arc deployment mode.
  - Local UI
    The default method to manage Arc is through the upstream Nozomi Networks product, which applies configurations to all Arc sensors in Service mode. However, it is also possible to manage Arc through a local UI for One-shot and Offline executions.
    - Configuration
      The Configuration page lets you define upstream connection settings, execution options, protection preferences, and traffic monitoring parameters for the Arc sensor.
    - Status
      The Status section shows a list of all the required dependencies for the selected sensor, and the installation status for each dependency.
    - Latest run
      The Latest run section shows the status and mode of the latest run that was executed.
    - Asset inventory
      The Asset inventory section displays the status of Discovery and Smart Polling. These features provide visibility into networked devices and asset details.
    - Last 100 runs
      The Last 100 runs section shows the status of the last 100 runs.
    - This asset
      The This asset tab displays information about the host on which Arc is running, across several tabs.
    - Alerts
      The Alerts page lists every alert that the sensor has generated.
    - Compliance
      The Compliance tab shows compliance information for the host on which Arc is running, across several tabs.
      - Why use Compliance
        Compliance runs standards-based hardening benchmarks against the host on which Arc is running, replacing one-off manual audits with auditable evidence of its security posture.
      - Benchmark management
        The Benchmark management tab lists the benchmarks available on this Arc sensor.
      - Policies
        The Policies tab lists the policies configured on this Arc sensor.
      - Scan logs
        The Scan logs tab lists the compliance scans that have run on this Arc sensor.
        Compliance scan logs
        A scan log entry records how a compliance scan was triggered and what it found.
        Compliance statuses
        Describes the status values used at each level of a compliance scan.
        View scan results
        Review the results of a completed compliance scan.
        Download scan results
        Download the raw scan artifact for a benchmark, in XML or HTML format.
        View benchmark rules
        Review the individual rule results within a benchmark that ran as part of a scan.
    - Offline archives
      The Offline archives page shows a list of the offline archives created on the host.
    - Open the local UI
      The local UI lets you manage Arc without the use of a parent system software. It gives you access to the Status page to monitor the status of Arc executions, and the Configuration page to configure Arc executions. You can double-click the executable file to open it, or use the command-line interface (CLI).
  - Compliance scanning
    Arc is the sensor that Compliance scans run against. Compliance scans run only when they are requested from the upstream system that manages the sensor.
  - Shell commands
    A list of available shell commands.
- Deployment
  Information on how to deploy Arc. This includes details for manual and automatic deployments, and deployment through a mobile device management (MDM) system.
- Execution
  Information on the different modes that you can use with Arc.
- Troubleshooting
  Troubleshooting procedures to help you solve problems that might occur when you use Arc.

Scan logs

The Scan logs tab lists the compliance scans that have run on this Arc sensor.

For more details, see Compliance scan logs.

Because Arc scans only the host it runs on, the Scan logs page has no Target column. Because Arc has no scheduling, it has no Schedule column either. Instead, it has a Source column, matching the one on the Policies page.

Column descriptions

Column label	Description
Policy	The policy the scan ran.
Created at	When the scan was created.
Trigger	How the scan was triggered: Manual.
Status	The scan's status. See Compliance statuses.
Benchmarks	The number of benchmarks included in the scan.
Failed rules	The number of rules that failed.
Total rules	The total number of rules evaluated.
Duration	How long the scan took to run.
Source	Whether the scan ran from a locally-created policy (Local), or was requested from upstream (Remote).