Home
Arc
Arc is a host-based sensor that detects and defends against malicious or compromised endpoints and insider attacks.
Configuration
Details on how to configure Arc.
Local UI
The default method to manage Arc is through the upstream Nozomi Networks product, which applies configurations to all Arc sensors in Service mode. However, it is also possible to manage Arc through a local UI for One-shot and Offline executions.
Compliance
The Compliance tab shows compliance information for the host on which Arc is running, across several tabs.
Scan logs
The Scan logs tab lists the compliance scans that have run on this Arc sensor.
View benchmark rules
Review the individual rule results within a benchmark that ran as part of a scan.

Arc
Arc is a host-based sensor that detects and defends against malicious or compromised endpoints and insider attacks.
- Introduction
  An overview of Arc.
- Requirements
  The machine and network requirements necessary to use Arc.
- Preparation
  Information on how to import Arc packages, and install a license.
- Configuration
  Details on how to configure Arc.
  - Configure an Arc sensor in Guardian
    You can configure an individual Arc sensor in Guardian directly from the Sensors details page for the related sensor.
  - Configure an Arc sensor in Vantage
    You can configure an individual Arc sensor in Vantage directly from the Sensors details page for the related sensor. Arc sensors in Service mode use these settings.
  - Discovery and Smart Polling conditions
    The minimum conditions required to run Discovery and Smart Polling on Arc depend on the Arc deployment mode.
  - Local UI
    The default method to manage Arc is through the upstream Nozomi Networks product, which applies configurations to all Arc sensors in Service mode. However, it is also possible to manage Arc through a local UI for One-shot and Offline executions.
    - Configuration
      The Configuration page lets you define upstream connection settings, execution options, protection preferences, and traffic monitoring parameters for the Arc sensor.
    - Status
      The Status section shows a list of all the required dependencies for the selected sensor, and the installation status for each dependency.
    - Latest run
      The Latest run section shows the status and mode of the latest run that was executed.
    - Asset inventory
      The Asset inventory section displays the status of Discovery and Smart Polling. These features provide visibility into networked devices and asset details.
    - Last 100 runs
      The Last 100 runs section shows the status of the last 100 runs.
    - This asset
      The This asset tab displays information about the host on which Arc is running, across several tabs.
    - Alerts
      The Alerts page lists every alert that the sensor has generated.
    - Compliance
      The Compliance tab shows compliance information for the host on which Arc is running, across several tabs.
      - Why use Compliance
        Compliance runs standards-based hardening benchmarks against the host on which Arc is running, replacing one-off manual audits with auditable evidence of its security posture.
      - Benchmark management
        The Benchmark management tab lists the benchmarks available on this Arc sensor.
      - Policies
        The Policies tab lists the policies configured on this Arc sensor.
      - Scan logs
        The Scan logs tab lists the compliance scans that have run on this Arc sensor.
        Compliance scan logs
        A scan log entry records how a compliance scan was triggered and what it found.
        Compliance statuses
        Describes the status values used at each level of a compliance scan.
        View scan results
        Review the results of a completed compliance scan.
        Download scan results
        Download the raw scan artifact for a benchmark, in XML or HTML format.
        View benchmark rules
        Review the individual rule results within a benchmark that ran as part of a scan.
    - Offline archives
      The Offline archives page shows a list of the offline archives created on the host.
    - Open the local UI
      The local UI lets you manage Arc without the use of a parent system software. It gives you access to the Status page to monitor the status of Arc executions, and the Configuration page to configure Arc executions. You can double-click the executable file to open it, or use the command-line interface (CLI).
  - Compliance scanning
    Arc is the sensor that Compliance scans run against. Compliance scans run only when they are requested from the upstream system that manages the sensor.
  - Shell commands
    A list of available shell commands.
- Deployment
  Information on how to deploy Arc. This includes details for manual and automatic deployments, and deployment through a mobile device management (MDM) system.
- Execution
  Information on the different modes that you can use with Arc.
- Troubleshooting
  Troubleshooting procedures to help you solve problems that might occur when you use Arc.

View benchmark rules

Review the individual rule results within a benchmark that ran as part of a scan.

Procedure

In the top navigation bar, select Compliance.
The Compliance page opens.
Select the Scan logs tab.
Select the applicable scan.
Select the applicable benchmark to expand its details, then select View rules.
If the benchmark's status is Not applicable, the benchmark was sent to the scan but returned no result. This is most likely because it does not apply to the operating system (OS) family of the host it ran against.
Select the applicable rule to expand its details.
Along with its rule identifier (ID) and override status, the rule detail panel shows:
- Description: Background information about what the rule checks and why it matters
- Remediation: The recommended action to bring the host into compliance with the rule
- Evidence: The technical scan output used to evaluate the rule, including the specific test results

Results

The Benchmark rules panel opens, showing counts of failed, passed, and overridden rules, and the total number of rules. The rule list shows each rule's result, for example Pass or Fail, and its severity. You can filter the list by status (All, Failed, Passed, Overridden), by severity (All severities, Critical, High, Medium, Low), or search by rule ID or title.