Home
Arc
Arc is a host-based sensor that detects and defends against malicious or compromised endpoints and insider attacks.
Configuration
Details on how to configure Arc.
Local UI
The default method to manage Arc is through the upstream Nozomi Networks product, which applies configurations to all Arc sensors in Service mode. However, it is also possible to manage Arc through a local UI for One-shot and Offline executions.
Compliance
The Compliance tab shows compliance information for the host on which Arc is running, across several tabs.
Scan logs
The Scan logs tab lists the compliance scans that have run on this Arc sensor.
View scan results
Review the results of a completed compliance scan.

Arc
Arc is a host-based sensor that detects and defends against malicious or compromised endpoints and insider attacks.
- Introduction
  An overview of Arc.
- Requirements
  The machine and network requirements necessary to use Arc.
- Preparation
  Information on how to import Arc packages, and install a license.
- Configuration
  Details on how to configure Arc.
  - Configure an Arc sensor in Guardian
    You can configure an individual Arc sensor in Guardian directly from the Sensors details page for the related sensor.
  - Configure an Arc sensor in Vantage
    You can configure an individual Arc sensor in Vantage directly from the Sensors details page for the related sensor. Arc sensors in Service mode use these settings.
  - Discovery and Smart Polling conditions
    The minimum conditions required to run Discovery and Smart Polling on Arc depend on the Arc deployment mode.
  - Local UI
    The default method to manage Arc is through the upstream Nozomi Networks product, which applies configurations to all Arc sensors in Service mode. However, it is also possible to manage Arc through a local UI for One-shot and Offline executions.
    - Configuration
      The Configuration page lets you define upstream connection settings, execution options, protection preferences, and traffic monitoring parameters for the Arc sensor.
    - Status
      The Status section shows a list of all the required dependencies for the selected sensor, and the installation status for each dependency.
    - Latest run
      The Latest run section shows the status and mode of the latest run that was executed.
    - Asset inventory
      The Asset inventory section displays the status of Discovery and Smart Polling. These features provide visibility into networked devices and asset details.
    - Last 100 runs
      The Last 100 runs section shows the status of the last 100 runs.
    - This asset
      The This asset tab displays information about the host on which Arc is running, across several tabs.
    - Alerts
      The Alerts page lists every alert that the sensor has generated.
    - Compliance
      The Compliance tab shows compliance information for the host on which Arc is running, across several tabs.
      - Why use Compliance
        Compliance runs standards-based hardening benchmarks against the host on which Arc is running, replacing one-off manual audits with auditable evidence of its security posture.
      - Benchmark management
        The Benchmark management tab lists the benchmarks available on this Arc sensor.
      - Policies
        The Policies tab lists the policies configured on this Arc sensor.
      - Scan logs
        The Scan logs tab lists the compliance scans that have run on this Arc sensor.
        Compliance scan logs
        A scan log entry records how a compliance scan was triggered and what it found.
        Compliance statuses
        Describes the status values used at each level of a compliance scan.
        View scan results
        Review the results of a completed compliance scan.
        Download scan results
        Download the raw scan artifact for a benchmark, in XML or HTML format.
        View benchmark rules
        Review the individual rule results within a benchmark that ran as part of a scan.
    - Offline archives
      The Offline archives page shows a list of the offline archives created on the host.
    - Open the local UI
      The local UI lets you manage Arc without the use of a parent system software. It gives you access to the Status page to monitor the status of Arc executions, and the Configuration page to configure Arc executions. You can double-click the executable file to open it, or use the command-line interface (CLI).
  - Compliance scanning
    Arc is the sensor that Compliance scans run against. Compliance scans run only when they are requested from the upstream system that manages the sensor.
  - Shell commands
    A list of available shell commands.
- Deployment
  Information on how to deploy Arc. This includes details for manual and automatic deployments, and deployment through a mobile device management (MDM) system.
- Execution
  Information on the different modes that you can use with Arc.
- Troubleshooting
  Troubleshooting procedures to help you solve problems that might occur when you use Arc.

View scan results

Review the results of a completed compliance scan.

Procedure

In the top navigation bar, select Compliance.
The Compliance page opens.
Select the Scan logs tab.
Select the applicable scan.

Results

The Scan overview section shows the policy that ran, its version, and its overall status, for example Non-compliant. Expand the overview to see the scan's Duration, Scan started at, and Scan completed at. Below the overview, the Benchmarks section lists each benchmark that ran, with counts of evaluated benchmarks and failed rules. Each benchmark row shows its version, status, highest severity, and rule counts, and lets you select Download XML, Download HTML, or View rules. Expand a benchmark to see its details. See View benchmark rules.