Docs

Security

Security events from devices, Microsoft 365, network devices and sensors, the detections and incidents they raise, threat intelligence, EDR actions, device protection, vulnerabilities and the remote access tool finder, with Cyber Essentials, compliance frameworks and awareness training in the Governance and compliance area.

  1. 1 Security overview What the Security area covers, where its events come from, how its menu is laid out, and how to read the security overview page.
  2. 2 Working detections Triage, take, investigate and close detections, see what found them, use AI on them, see VIPs and critical devices, recognise your own Microsoft 365 app, mark a tool's routine scripts and false positives, and follow the alert and ticket each one raised, or why there is none.
  3. 3 Searching security events Search every security event across devices, Microsoft 365, network devices and integrations, in the search language or in plain English, with saved searches, live tail and export.
  4. 4 Detection rules and suppressions The built-in detection rules, each rule's noise and automatic lowering, tuning a rule for one customer, testing and writing your own rules, rules switched off for failing, and suppressing hits you do not want.
  5. 5 Event sources and collection Check that every device, tenant and network device is sending security events, choose what agents collect, add firewalls and gateways that send syslog, and see how every address is enriched.
  6. 6 Device protection See each device's antivirus, EDR, firewall, disk encryption and local administrators, the findings against your limits, and the alerts when protection is lost.
  7. 7 Integrations and alerting Connect Microsoft Defender and SentinelOne with your own accounts so their alerts become detections, and choose which detections raise alerts and tickets.
  8. 8 Cyber Essentials readiness Turn Cyber Essentials tracking on per customer, see how ready each one is, what to fix first, their certificates, and export a readiness report for the customer or an assessor.
  9. 9 Vulnerability management Known vulnerabilities in the software and operating systems on every device, rated the vendor's way, prioritised by what can be done, with a deadline and the fix Tenvara can apply through patching or software deployment.
  10. 10 Network intrusion detection Turn a Linux device with the Tenvara agent into a Suricata network sensor on a switch mirror port, and get its alerts as detections, with the sensor's health watched for you.
  11. 11 Log retention and archive Keep security events searchable for up to ten years or without limit, archive older days to cheap storage as compressed files, and bring a range back for an investigation.
  12. 12 EDR actions Isolate devices, run scans, deal with threats, manage exclusions and deploy the agent through Microsoft Defender for Endpoint and SentinelOne without leaving Tenvara.
  13. 13 Security awareness training Run phishing simulations for your customers' staff, give them short lessons with quizzes, ask them to accept policies, and see a risk score for each person.
  14. 14 Compliance frameworks Assess customers against Essential Eight, NIST CSF 2.0, CIS Controls v8.1, NIS2, ISO 27001, ISO 9001, UK GDPR and your own frameworks beside Cyber Essentials, from live checks and attestations, with what to fix first, evidence, review dates and a PDF for the customer.
  15. 15 Incidents and response Incidents that group related detections, response targets and metrics, pinned evidence and tickets, telling the customer, the incident report, digests and the security scorecard.
  16. 16 Threat intelligence and MITRE coverage Known bad addresses from abuse.ch, Spamhaus and Emerging Threats on events and detections, country and network owner for every address, and the MITRE ATT&CK coverage of your rules.
  17. 17 Syslog relays Collect syslog from firewalls, switches and printers at a site through a device with the agent, without sending syslog across the internet or opening a VPN.
  18. 18 The remote access and RMM tool finder Find other remote access tools and RMM agents on every device, allow the ones that belong at three levels, ignore a version, remove the rest silently, and use it while taking a customer over.
  19. 19 Vulnerability priorities, fix states and To do How Tenvara rates each vulnerability the vendor's way, what the six fix states mean, how Critical, High, Routine and Mitigate are worked out from what can be done, how exposure is judged, and how the To do list groups work by the update that fixes it.