Home
Arc
Learn how Arc provides endpoint security in high availability environments.
Arc
Configuration
Details on how to configure Arc.
Local UI
The default method to manage Arc is through the upstream Nozomi Networks product, which applies configurations to all Arc sensors in Service mode. However, it is also possible to manage Arc through a local UI for One-shot and Offline executions.
Alerts
The Alerts page lists every alert that the sensor has generated.

Arc
Learn how Arc provides endpoint security in high availability environments.
- Arc
  - Introduction
    An overview of Arc.
  - Requirements
    The machine and network requirements necessary to use Arc.
  - Preparation
    Information on how to import Arc packages, and install a license.
  - Configuration
    Details on how to configure Arc.
    - Configure an Arc sensor in Guardian
      You can configure an individual Arc sensor in Guardian directly from the Sensors details page for the related sensor.
    - Configure an Arc sensor in Vantage
      You can configure an individual Arc sensor in Vantage directly from the Sensors details page for the related sensor. Arc sensors in Service mode use these settings.
    - Discovery and Smart Polling conditions
      The minimum conditions required to run Discovery and Smart Polling on Arc depend on the Arc deployment mode.
    - Local UI
      The default method to manage Arc is through the upstream Nozomi Networks product, which applies configurations to all Arc sensors in Service mode. However, it is also possible to manage Arc through a local UI for One-shot and Offline executions.
      - Configuration
        The Configuration page lets you define upstream connection settings, execution options, protection preferences, and traffic monitoring parameters for the Arc sensor.
      - Status
        The Status section shows a list of all the required dependencies for the selected sensor, and the installation status for each dependency.
      - Latest run
        The Latest run section shows the status and mode of the latest run that was executed.
      - Asset inventory
        The Asset inventory section displays the status of Discovery and Smart Polling. These features provide visibility into networked devices and asset details.
      - Last 100 runs
        The Last 100 runs section shows the status of the last 100 runs.
      - This asset
        The This asset tab displays information about the host on which Arc is running, across several tabs.
      - Alerts
        The Alerts page lists every alert that the sensor has generated.
      - Offline archives
        The Offline archives page shows a list of the offline archives created on the host.
      - Open the local UI
        The local UI lets you manage Arc without the use of a parent system software. It gives you access to the Status page to monitor the status of Arc executions, and the Configuration page to configure Arc executions. You can double-click the executable file to open it, or use the command-line interface (CLI).
    - Shell commands
      A list of available shell commands.
  - Deployment
    Information on how to deploy Arc. This includes details for manual and automatic deployments, and deployment through a mobile device management (MDM) system.
  - Execution
    Information on the different modes that you can use with Arc.
  - Troubleshooting
    Troubleshooting procedures to help you solve problems that might occur when you use Arc.
- Arc Embedded
  Arc Embedded is a cybersecurity sensor built into PLCs to provide real-time visibility and deep threat detection within industrial control systems.
- Print format documentation
  A list of all the print-format documentation that is available for Arc and Arc Embedded.

Alerts

The Alerts page lists every alert that the sensor has generated.

Alerts page in the Arc local UI showing a table of alerts with columns for time, name, type, risk, source, destination, and description — Figure 1. Alerts page

Live

The Live toggle lets you change live view on, or off. When live mode is on, the page will refresh periodically.

Refresh

The Refresh icon lets you immediately refresh the current view.

Columns

The Columns button lets you select which of the available columns for the current page will show.

Time

The date and time at which the alert was generated. By default, alerts are sorted by time, most recent first.

Name

The name of the alert.

Type

The type of alert.

Risk

The risk level associated with the alert.

Source

The label or internet protocol (IP) address of the source associated with the alert.

Destination

The label or IP address of the destination associated with the alert.

Description

A description of the alert.

Alert sources

The sensor generates alerts from the following detection sources:

universal serial bus (USB) events: A USB device is plugged in or unplugged, draws unusual power, releases a scripted key, or transfers data
Sigma rule matches
Structured Threat Information Expression (STIX) indicator matches
Windows Defender detections
Malware rule matches