Home
Arc
Arc is a host-based sensor that detects and defends against malicious or compromised endpoints and insider attacks.
Configuration
Details on how to configure Arc.
Local UI
The default method to manage Arc is through the upstream Nozomi Networks product, which applies configurations to all Arc sensors in Service mode. However, it is also possible to manage Arc through a local UI for One-shot and Offline executions.
Configuration
The Configuration page lets you define upstream connection settings, execution options, protection preferences, and traffic monitoring parameters for the Arc sensor.
Upstream
Configure and verify the connection between the Arc sensor and the upstream machine using an IP address and authentication token. The page also displays the sensor ID and optional certificate validation and web proxy settings.

Arc
Arc is a host-based sensor that detects and defends against malicious or compromised endpoints and insider attacks.
- Introduction
  An overview of Arc.
- Requirements
  The machine and network requirements necessary to use Arc.
- Preparation
  Information on how to import Arc packages, and install a license.
- Configuration
  Details on how to configure Arc.
  - Configure an Arc sensor in Guardian
    You can configure an individual Arc sensor in Guardian directly from the Sensors details page for the related sensor.
  - Configure an Arc sensor in Vantage
    You can configure an individual Arc sensor in Vantage directly from the Sensors details page for the related sensor. Arc sensors in Service mode use these settings.
  - Discovery and Smart Polling conditions
    The minimum conditions required to run Discovery and Smart Polling on Arc depend on the Arc deployment mode.
  - Local UI
    The default method to manage Arc is through the upstream Nozomi Networks product, which applies configurations to all Arc sensors in Service mode. However, it is also possible to manage Arc through a local UI for One-shot and Offline executions.
    - Configuration
      The Configuration page lets you define upstream connection settings, execution options, protection preferences, and traffic monitoring parameters for the Arc sensor.
      - Upstream
        Configure and verify the connection between the Arc sensor and the upstream machine using an IP address and authentication token. The page also displays the sensor ID and optional certificate validation and web proxy settings.
      - Endpoint
        Configure detection options for endpoint monitoring in Arc. Arc collects endpoint data, validates assets using ARP, and detects malware with configurable response actions.
      - Network sensor
        Configure Arc network sensor features such as Discovery, Smart Polling, and traffic monitoring. These options help identify neighboring devices, enrich asset data, and analyze network traffic patterns.
      - Other
        Set Arc log verbosity, data collection duration, disk space usage limits, and the offline archive naming strategy for One-shot and Offline modes. These options help manage local resource usage and troubleshoot performance.
    - Status
      The Status section shows a list of all the required dependencies for the selected sensor, and the installation status for each dependency.
    - Latest run
      The Latest run section shows the status and mode of the latest run that was executed.
    - Asset inventory
      The Asset inventory section displays the status of Discovery and Smart Polling. These features provide visibility into networked devices and asset details.
    - Last 100 runs
      The Last 100 runs section shows the status of the last 100 runs.
    - This asset
      The This asset tab displays information about the host on which Arc is running, across several tabs.
    - Alerts
      The Alerts page lists every alert that the sensor has generated.
    - Compliance
      The Compliance tab shows compliance information for the host on which Arc is running, across several tabs.
    - Offline archives
      The Offline archives page shows a list of the offline archives created on the host.
    - Open the local UI
      The local UI lets you manage Arc without the use of a parent system software. It gives you access to the Status page to monitor the status of Arc executions, and the Configuration page to configure Arc executions. You can double-click the executable file to open it, or use the command-line interface (CLI).
  - Compliance scanning
    Arc is the sensor that Compliance scans run against. Compliance scans run only when they are requested from the upstream system that manages the sensor.
  - Shell commands
    A list of available shell commands.
- Deployment
  Information on how to deploy Arc. This includes details for manual and automatic deployments, and deployment through a mobile device management (MDM) system.
- Execution
  Information on the different modes that you can use with Arc.
- Troubleshooting
  Troubleshooting procedures to help you solve problems that might occur when you use Arc.

Upstream

Configure and verify the connection between the Arc sensor and the upstream machine using an IP address and authentication token. The page also displays the sensor ID and optional certificate validation and web proxy settings.

Upstream connection page showing Arc sensor ID, upstream connection IP address, authentication token, and web proxy fields with a Copy button for the sensor ID — Figure 1. Upstream

Sensor ID

This is the identifier (ID) of the Arc sensor that is used to connect to the upstream sensor.

Upstream Connection

This shows the internet protocol (IP) address of the upstream machine that the sensor is connected to.

CAUTION:

After the upstream connection is initially set to a Guardian under the Central Management Console (CMC), it is not possible to update it to another Guardian under the same CMC. You need to reconfigure the upstream connection manually. This is best done with the help of Nozomi Networks Customer Support.

Verify TLS Certificate

Select this option to enforce verification of the upstream transport layer security (TLS) certificate when connecting to Guardian. When using Vantage, TLS certificate validation is always enforced, regardless of this setting.

Token

The token Arc needs to authenticate to the Guardian/Vantage endpoint.

Enable proxy

Select this option to connect to the upstream endpoint through a web proxy.

Host: The hostname of the proxy server
Port: The port that the proxy server uses for connections

Check connection

This button checks if the connection parameters are correct.