Device protection

The Tenvara agent reports each device's protection every few hours. Security > Protection judges every report against your limits and lists what needs fixing, fleet-wide or for one customer.

The protection list#

The top of the page sums up every device that reports:

• Healthy: the share of devices with no findings.
• No or disabled antivirus: none installed, or switched off.
• Firewall off: on at least one profile.
• Not encrypted: where encryption is required.
• Extra admins: local administrators outside the allowed list.
• Not reporting: devices that have never reported, or are online but have gone quiet for too long.

Click a figure to open the matching view. The list shows each device with its Customer, Findings (with the worst one spelled out), Antivirus, EDR, Firewall and Encryption, devices with findings first. Filter by customer, OS and state, or use the Views picker: Issues, No or disabled antivirus, No encryption, Firewall off, Extra admins, EDR problems and Not reporting.

One device's protection#

Click a device to open its protection in a side panel:

• The OS and version, the number of findings, and when it last reported.
• Antivirus, EDR, Firewall, Encryption and Local admins at a glance.
• Findings, each with its severity.
• The full report: every antivirus product and its state and signature age, each firewall profile, each encrypted volume, local administrators, and the rest of the configuration checked.
• A timeline of changes: findings that appeared or went, administrators added or removed, the OS changing, EDR sensors found or gone.

Press Check now (or c on the list) to ask the agent for a fresh report straight away. The same information appears in the Protection block on the Overview tab of the device's own page. The Encryption block beside it lists each BitLocker volume and whether its recovery key is held in the vault: see BitLocker recovery keys.

What is checked#

Always checked:

• Antivirus: none installed, switched off, real-time protection off, or signatures older than the limit (shown as Out of date).
• Firewall: off, or any profile off. On Linux the finding names the firewall that was read, for example "ufw is inactive." or "firewalld is not running.", and is a warning rather than critical. On a Proxmox VE host the agent reads pve-firewall, the host's own firewall, so an empty nftables ruleset there is not a finding.
• Encryption: the system volume not encrypted (BitLocker, FileVault, LUKS) where encryption is required. By default that is laptops only.
• Local administrators: accounts outside the allowed list. Names match without the domain or machine in front, whatever the case.
• EDR: a sensor that is not healthy, or missing on a device that should have the console's agent, such as SentinelOne's (see Which devices should have the EDR agent). A sensor still starting just after the device boots is not counted as unhealthy. A device marked Not expected on this device, with a reason, is never told off for a missing agent.
• Not reporting: online, but no report for longer than the limit.

Also checked, and each can be switched off: Defender tamper protection off, the built-in Administrator enabled with its default name, the guest account enabled, the screen never locking or locking too late, short passwords or no account lockout, SMB version 1, AutoRun, Remote Desktop without Network Level Authentication, automatic updates off, Secure Boot off (information only), SSH allowing root to sign in directly, and leftover antivirus (another antivirus product installed but not protecting the device).

Settings#

Go to the Protection tab of Settings > Security monitoring (administrators).

1. Under Limits, set how old antivirus signatures may be, how late the screen may lock, when a device counts as not reporting, how long EDR sensors may start for after the device starts up, the minimum password length, the lockout threshold, and where Disk encryption required on applies (Laptops only, Every device or Nowhere).
2. Under Allowed local administrators, list the accounts and groups expected to be administrators everywhere, such as your own support account. Customers can have their own additions.
3. Under Findings, switch off any optional check you do not want.
4. Under Alerts, choose which changes raise an alert and at what severity. A Linux device with no antivirus keeps its finding but raises no alert unless you switch on Also for Linux devices with no antivirus.
5. Save. Every stored report is judged again straight away.

Customers can have their own allowed administrators, encryption requirement, screen lock and signature limits.

Alerts#

These alerts are raised when a device goes wrong, not on every report, and clear when it is fixed:

Resolving an alert while the problem is still there does not page you again. Your alert rules can turn these into tickets. Defender or the firewall switched off and back on within 10 minutes raises nothing.

Devices where a check does not apply#

Some devices should never run an EDR agent or a host firewall, and Tenvara works this out from what it knows about them rather than from a list of products:

• Hypervisor hosts (Proxmox VE and similar Linux hosts): no EDR agent is expected, and the firewall is judged by pve-firewall.
• Appliances (a phone system, a network console, anything that is not a Windows or macOS computer and is filed as a network device, has no package manager or a read-only firmware image, or that nobody updates): neither an EDR agent nor a host firewall is expected.

A Windows server with the Hyper-V role is still a Windows server, so EDR and Windows Firewall still apply there. The device's protection says why under Not counted, and the Firewall fact reads Not applicable.

For anything else, a Firewall is off or EDR agent missing alert has Not applicable for this device. Give a reason: the alert resolves as expected with that reason, the check is left out for that device, and the change is audited. Check it again (firewall) or Expect it again (EDR) in the device's protection takes it back, and if the problem is still there the alert opens again.

For how the Tenvara agent itself behaves alongside antivirus and attack surface reduction rules, see Security software and the agent.

Tip: Protection feeds Cyber Essentials: firewalls, malware protection, secure configuration and local administrators all come from these reports. See Cyber Essentials readiness.