Home
Vantage
SaaS security and visibility across your OT, IoT, and IT networks.
User Guide
Information about the main features of Vantage and the tasks that you can do from the user interface (UI).
Compliance
The Compliance page lets you scan Arc sensors against SCAP and STIG benchmarks, group benchmarks into versioned policies, run scans on demand or on schedules, and review results with support for per-rule overrides.
Rule overrides
A rule override lets you record a justification for a specific rule result without changing the underlying scan data.
Override a rule result
Change a rule's compliance result and record a justification, without changing the underlying scan data.

Vantage
SaaS security and visibility across your OT, IoT, and IT networks.
- Introduction
  An overview of Vantage.
- Administrator Guide
  Information about the Administration section of Vantage, and the tasks that you can do in this part of the software.
- User Guide
  Information about the main features of Vantage and the tasks that you can do from the user interface (UI).
  - Sensors
    The Sensors page shows all the sensors connected to your Vantage system.
  - Alerts
    The Alerts page shows all the alerts notifications that your sensors pass to Vantage related to security incidents in your network. This page lets you learn about the alerts, edit their values and post comments.
  - Assets
    The Assets page shows all the physical components and systems that Vantage has detected through your sensors. Composed of one or more nodes, assets are the fundamental resources that Vantage protects.
  - Wireless
    The Wireless page lets you buy and connect a Guardian Air sensor. Once you have connected one or more Guardian Air sensor, the Wireless page show the connected Guardian Air sensors.
  - Queries
    The Queries page lets you write queries for your system. You can also save queries and assertions to be used again.
  - Vulnerabilities
    The Vulnerabilities page shows a list of all the vulnerabilities that Vantage has detected in your system. Vulnerabilities are weaknesses that reduce the security of your system and give threat actors an opportunity to exploit your system.
  - Vantage IQ
    Vantage IQ helps you navigate and explore your network. You can use smart query commands to leverage advanced machine learning and data analytic algorithms to dive deeper into your data.
  - Network
    The Network page shows a visual representation of your network and all its assets.
  - Graph
    Displays a visual map of your network, highlighting asset connections and communication paths. Users can switch between network and physical views to explore infrastructure relationships.
  - Process
    The Process page shows a list of processes in your environment. Processes are a set of repeatable functions that a business does to deliver a core value.
  - Dashboards
    The Dashboards page shows a list of all the dashboards that have been created.
  - Reports
    The Reports page shows all the reports that the sensors in your system have created.
  - Sites
    The Sites page shows all the geographical locations of the assets in your system. It lets you associate a site to one or more network domains. You can also add details such as the country or city of the site.
  - Workbooks
    The Workbooks page shows recommended courses of action that can improve your network security. Generated through machine learning, workbooks highlight the vulnerabilities currently creating the highest risk exposure.
  - Threat Intelligence
    The Threat Intelligence page shows an overview of all of the available threat cards and categories. It also lets you filter the threat cards to show only malware, threat actors, or vulnerabilities
  - Asset Risk
    The Asset Risk page provides an in-depth view of asset risk levels. This includes an overview, detailed analysis, and benchmark comparisons to help assess and manage risks effectively.
  - Smart Polling
    Smart Polling provides a centralized interface for creating, managing, and monitoring polling plans within your organization. It helps you streamline data collection and control monitoring activities from one location.
  - Compliance
    The Compliance page lets you scan Arc sensors against SCAP and STIG benchmarks, group benchmarks into versioned policies, run scans on demand or on schedules, and review results with support for per-rule overrides.
    - Why use Compliance
      Compliance runs standards-based hardening benchmarks against your Arc sensors on a repeatable basis, replacing one-off manual audits with continuous, auditable evidence of their security posture.
    - Requirements
      Before you can use Compliance, your organization needs a Compliance license and Arc sensors that meet the supported platform and version requirements.
    - Enable or disable Compliance on an Arc sensor
      Turn the Compliance feature on or off for an individual Arc sensor.
    - Overview
      The Overview tab shows a fixed dashboard that summarizes compliance scan activity across your organization.
    - Benchmark management
      The Benchmark management tab lists the benchmarks available to your organization.
    - Policies
      The Policies tab lists the compliance policies available to your organization.
    - Schedules
      A schedule runs one compliance policy automatically against a set of targets, on a recurring basis.
    - Scan logs
      The Scan logs tab lists compliance scans and their results.
    - Benchmark applicability
      Vantage determines which benchmarks can run against a given Arc sensor based on platform compatibility and, for relevant-asset targeting, additional applicability checks.
    - Rule overrides
      A rule override lets you record a justification for a specific rule result without changing the underlying scan data.
      - Override reasons
        Describes the reasons you can select when you override a compliance rule result.
      - Override a rule result
        Change a rule's compliance result and record a justification, without changing the underlying scan data.
      - Edit a rule override
        Change the target result, reason, or justification of an existing rule override.
      - Remove a rule override
        Remove an override so the rule's original result applies again.
      - View the history of a rule override
        Review the chain of overrides applied to a rule over time.
  - Segmentation Advisor
    The Segmentation Advisor page helps you assess and improve your network segmentation by identifying risks and recommending actions.
  - Integrations
    The Data integrations page lets you connect Vantage to external systems by adding and managing data importers and exporters.
  - Async operations
    The Async operations page lets you keep track of tasks that are being executed in the background, and it shows their outcome once that they are completed.
  - What's new drawer
    The What's new drawer shows a list of new features, enhancements, and fixes for issues.
  - Administration
  - Profile settings
    The profile settings menu lets you edit your user settings and update your profile.
  - Organizations menu
    The organizations menu lets you search or show a list of all of your organizations, and lets you switch between them. Vantage provides a default organization, but administrators can add more organizations as necessary.

Override a rule result

Change a rule's compliance result and record a justification, without changing the underlying scan data.

About this task

Any scanner result can be overridden except Not selected and Informational, which cannot be overridden at all. Pass, Fail, and Not applicable results can each be changed to either of the other two verdicts; Error, Unknown, and Not checked results can be set to any of the three. Overriding a result to Fail requires an administrator role. Submitting the value the scanner already reported is rejected as a no-op. The justification field is required. Overrides are created one rule at a time; there is no bulk-override action in the user interface (UI). An override always applies to the current scan only, and there is no scope selector.

Procedure

In the top navigation bar, select > Compliance.
The Compliance page opens.
Select the Scan logs tab.
Select the applicable scan.
Select the applicable benchmark to expand its details, then select View rules.
If the benchmark produced no results, for example because its status is Not applicable and it does not apply to the operating system (OS) family of the host it ran against, the expanded panel shows This benchmark produced no results. instead of rule counts and timestamps.
Select the applicable rule to expand its details.
In the Override section, select Override result.
Under Override result to, select the result to override to.
The available options exclude the rule's current result. For example, if the rule failed, you can override it to Pass or Not applicable. Each option shows a short description of what it means.
From the Reason dropdown, select the applicable reason. See Override reasons.
Enter a Justification, then select Override result.

Results

The rule shows its overridden result and an Override marker. Expanded overridden rule showing reason scope applied timestamp and justification with edit remove and history actions

Expanded overridden rule showing reason scope applied timestamp and justification with edit remove and history actions

The Override section shows the Reason, Scope, and Applied timestamp, followed by the justification text, and offers Edit, Remove, and History actions. The override changes how the rule counts toward the benchmark's compliance percentage.