Security overview

The Security area is Tenvara's security monitoring. It collects security events from your customers' devices, Microsoft 365 tenants, network devices, network sensors and security consoles into one searchable store, runs detection rules over them, and turns what they find into detections your technicians work through, grouped into incidents when they belong together. It enriches every address with its country, network owner and whether threat intelligence lists know it to be bad. It also shows each device's protection (antivirus, EDR, firewall, encryption, local administrators), finds known vulnerabilities on every device, finds other remote access tools and RMM agents, holds devices to hardening baselines (see Device hardening overview) and keeps admin elevation, tamper protection, dark web monitoring and AI readiness in the same place.

Compliance work has its own area. Cyber Essentials, compliance frameworks, management systems, policy documents, audits and awareness training are under Governance and compliance, and read what Security collects. See Compliance frameworks and Management systems overview.

Where events come from#

Every event is stored with the same fields (who, which device, what action, the outcome, addresses, process, file and so on), so one search or rule can look across all of them. Events stay searchable for 90 days by default, up to ten years or without limit, and older days can go to a cheap archive: see Log retention and archive. The agent's security collection is set per device, group or customer: see Event sources and collection.

The Security menu#

Open Security from the rail. The sidebar starts with Overview (the page described below), then has three groups and a settings link.

Detect and respond#

• Detections: what the rules and integrations found. See Working detections.
• Security incidents: related detections worked together as one case. See Incidents and response.
• Events: search every security event. See Searching security events.
• Rules: what is looked for, with Suppressions (what is held back) and the MITRE ATT&CK Coverage as tabs on the same page. See Detection rules and suppressions and Threat intelligence and MITRE coverage.
• Sources: whether every device, tenant, network device and syslog relay is sending, a tab for each kind. See Event sources and collection.
• Network sensors: Suricata sensors and their health. See Network intrusion detection.

Protect#

• Protection: each device's antivirus, EDR, firewall and encryption. See Device protection.
• Vulnerabilities: known vulnerabilities on every device. It opens on To do, what can be fixed now grouped by the update that fixes it, with Waiting on vendor, Not yet assessed and Hidden beside it; the dashboard is the Overview tab (Vulnerability overview in search). See Vulnerability management and Vulnerability priorities, fix states and To do.
• Hardening: baseline compliance, baselines, the setting library and BitLocker keys, when Device hardening is switched on. See Device hardening overview and BitLocker recovery keys.
• Admin elevation: requests for administrator rights, with Rules and Report as tabs. See Admin elevation on request.
• Tamper protection: attempts to stop or remove the agent. See Tamper protection.
• Remote access tools: other remote access tools and RMM agents found on devices, with the count of those found and not allowed. See The remote access and RMM tool finder.
• Dark web monitoring: customers' addresses found in breaches. See Dark web monitoring.
• AI readiness: every assessed customer. See AI readiness overview and the score.

Report#

• Security reports: daily and weekly security digests and reports of up to 90 days.
• Scorecard: customers ranked by security risk. See Incidents and response for both.

Security settings at the bottom opens Settings > Security monitoring.

The quick filters for detections (New, Mine, High and critical, Breaching) are in the Views picker on the Detections list, and Incidents past a target is in the one on Security incidents. An item only shows when its module is switched on and your role allows it, so someone who only handles admin elevation still finds Security, with just that item.

Reading the overview#

Choose 7 days, 30 days or 90 days at the top right. The page follows the customer switcher, so you can look at one customer or all of them.

• New: detections nobody has picked up yet.
• Investigating: detections being worked, with how many are yours.
• High and critical open, with the number of critical ones.
• Closed in 7 days, with how many were false positives.
• Mean time to take and Mean time to resolve, each with the share within target, how many detections and incidents are Past a target, and Open incidents.
• Detections opened: a chart per day by severity.
• Needs attention: open detections, worst first, with a bar of how many are critical, high, medium, low and info.
• Security events: how many events arrived, by source, over the period, with Search events.
• Sources: how many are sending and how many have been quiet for a day.
• Protection: devices with no or disabled antivirus, the firewall off, no encryption where it is required, and extra local administrators.
• Response times per week and Response by customer: the mean times and the share within target.
• Busiest rules and Customers with the most open detections.

When nothing is set up yet (no rules, no events, or rules failing), the overview says what to do next.

Where else security shows up#

• Device page: on the Overview tab, a Security block with open detections, notable events in the last 24 hours and a link to search the device's events, a Protection block, an Encryption block with the BitLocker recovery keys held, a Security tools block for connected consoles, a Vulnerabilities block, any remote access tools found on it and, on a sensor, its Network sensor block. Search security events is in the device's More actions menu.
• Customer page: the Security tab, with Security, Vulnerabilities, Hardening and AI readiness beneath it, and the Compliance tab, with Compliance frameworks, Cyber Essentials and Sign-offs.
• Home: a Security block, which also says how many open detections have an open alert (for example "4 of 6") and links to Alerts, where the Security detections source counts every open security alert, protection and sources included. A detection that raised no alert says why on its page: see Working detections.
• Alerts and tickets: detections at or above a set severity raise alerts, which your alert rules can turn into tickets. See Integrations and alerting.
• Customer portal: published incident reports appear on the Reports page. Staff take their security training and accept policies there too, and published compliance reports and management system programmes appear on the Compliance page.
• AI: once AI is set up, the assistant can explain and triage detections, answer questions about a detection or incident, and turn a plain-English question into an event search. See Working detections.

Permissions#

Security has its own permission area in Roles and permissions:

Vulnerabilities, device hardening, AI readiness and management systems each have their own permission area. Remote access tools follows the Software permission, and dark web monitoring follows the credentials vault's.

If the Security module is switched off in Modules, its pages disappear and agents are told to stop collecting.