Home
Arc
Arc is a host-based sensor that detects and defends against malicious or compromised endpoints and insider attacks.
Configuration
Details on how to configure Arc.
Local UI
The default method to manage Arc is through the upstream Nozomi Networks product, which applies configurations to all Arc sensors in Service mode. However, it is also possible to manage Arc through a local UI for One-shot and Offline executions.
Configuration
The Configuration page lets you define upstream connection settings, execution options, protection preferences, and traffic monitoring parameters for the Arc sensor.
Other
Set Arc log verbosity, data collection duration, disk space usage limits, and the offline archive naming strategy for One-shot and Offline modes. These options help manage local resource usage and troubleshoot performance.

Arc
Arc is a host-based sensor that detects and defends against malicious or compromised endpoints and insider attacks.
- Introduction
  An overview of Arc.
- Requirements
  The machine and network requirements necessary to use Arc.
- Preparation
  Information on how to import Arc packages, and install a license.
- Configuration
  Details on how to configure Arc.
  - Configure an Arc sensor in Guardian
    You can configure an individual Arc sensor in Guardian directly from the Sensors details page for the related sensor.
  - Configure an Arc sensor in Vantage
    You can configure an individual Arc sensor in Vantage directly from the Sensors details page for the related sensor. Arc sensors in Service mode use these settings.
  - Discovery and Smart Polling conditions
    The minimum conditions required to run Discovery and Smart Polling on Arc depend on the Arc deployment mode.
  - Local UI
    The default method to manage Arc is through the upstream Nozomi Networks product, which applies configurations to all Arc sensors in Service mode. However, it is also possible to manage Arc through a local UI for One-shot and Offline executions.
    - Configuration
      The Configuration page lets you define upstream connection settings, execution options, protection preferences, and traffic monitoring parameters for the Arc sensor.
      - Upstream
        Configure and verify the connection between the Arc sensor and the upstream machine using an IP address and authentication token. The page also displays the sensor ID and optional certificate validation and web proxy settings.
      - Endpoint
        Configure detection options for endpoint monitoring in Arc. Arc collects endpoint data, validates assets using ARP, and detects malware with configurable response actions.
      - Network sensor
        Configure Arc network sensor features such as Discovery, Smart Polling, and traffic monitoring. These options help identify neighboring devices, enrich asset data, and analyze network traffic patterns.
      - Other
        Set Arc log verbosity, data collection duration, disk space usage limits, and the offline archive naming strategy for One-shot and Offline modes. These options help manage local resource usage and troubleshoot performance.
    - Status
      The Status section shows a list of all the required dependencies for the selected sensor, and the installation status for each dependency.
    - Latest run
      The Latest run section shows the status and mode of the latest run that was executed.
    - Asset inventory
      The Asset inventory section displays the status of Discovery and Smart Polling. These features provide visibility into networked devices and asset details.
    - Last 100 runs
      The Last 100 runs section shows the status of the last 100 runs.
    - This asset
      The This asset tab displays information about the host on which Arc is running, across several tabs.
    - Alerts
      The Alerts page lists every alert that the sensor has generated.
    - Compliance
      The Compliance tab shows compliance information for the host on which Arc is running, across several tabs.
    - Offline archives
      The Offline archives page shows a list of the offline archives created on the host.
    - Open the local UI
      The local UI lets you manage Arc without the use of a parent system software. It gives you access to the Status page to monitor the status of Arc executions, and the Configuration page to configure Arc executions. You can double-click the executable file to open it, or use the command-line interface (CLI).
  - Compliance scanning
    Arc is the sensor that Compliance scans run against. Compliance scans run only when they are requested from the upstream system that manages the sensor.
  - Shell commands
    A list of available shell commands.
- Deployment
  Information on how to deploy Arc. This includes details for manual and automatic deployments, and deployment through a mobile device management (MDM) system.
- Execution
  Information on the different modes that you can use with Arc.
- Troubleshooting
  Troubleshooting procedures to help you solve problems that might occur when you use Arc.

Other

Set Arc log verbosity, data collection duration, disk space usage limits, and the offline archive naming strategy for One-shot and Offline modes. These options help manage local resource usage and troubleshoot performance.

Other configuration page showing log level dropdown, execution time in seconds, maximum disk space in megabytes, and an offline archive naming strategy dropdown for One-shot and Offline modes. — Figure 1. Other

Log level

This dropdown lets you select the verbosity level for the log files. The options are:

Debug
Info
Warning
Error

The logging system options have an increasing level of verbosity, from the least verbose to the most verbose. Error < Warning < Info < Debug.

Error: Creates a minimalistic log, only unexpected errors are logged
Warning: Creates extra errors that might show on some operating system (OS)s, but that are generally considered as acceptable
Info: Logs relevant successful events, it shows the program’s progress (recommended)
Debug: Logs extra events that are normally useful for debugging purposes. Given its verbosity it is best to activate it only when debugging activities are involved

Note:

This setting applies to:

arc.log.txt
arc_service.log.txt
sp.log.txt

It doesn't apply to setup.log, which covers Arc's initialization process, before the configuration has been loaded and applied.

For more details, see Log files.

Execution time

This field lets you set the time that Arc will run to collect data. This is applicable for One-shot and Offline modes.

Note:

When this is set to 0, the execution time is interpreted as infinite.

Maximum disk space

This field lets you control the maximum amount of disk space in megabyte (MB) that will be used for Offline mode.

Offline archive naming strategy

This dropdown lets you select the information to include in the name of the archive file that Arc creates when running in Offline mode. For example: arc_data_archive_[HOSTNAME]_[IP]_[YYYYMMDDhhmmss].zip.