About

Monitor shows the data your connected tools bring into ControlMap. Use it to see how your automated compliance checks are doing, which assets and vulnerabilities were found, and who has accounts, with or without MFA. Monitor is in the top group of the sidebar, with Dashboard and To do.

The Monitor page has six tabs, in this order: Dashboard, Compliance Checks, Assets, Vulnerabilities, User Accounts and Integrations. Each tab keeps its place when you switch between them.

Data from all your connected tools is shown together on each tab. Use the Integration column or the All integrations filter to tell the tools apart.

Dashboard

The Dashboard tab gives you a summary of everything Monitor tracks, so you can spot problems at a glance.

At the top are six summary tiles:

• System health: how many connected integrations are passing, with counts for Failing and Running.
• Open findings: the number of critical and high vulnerabilities, with a Critical count and a High count.
• MFA coverage: the percentage of users with MFA, and how many users that is out of the total.
• Asset health: how many assets are all clear out of all assets, with a count of assets with failures.
• Background checks: the number clear, with counts for Flagged, Expired, Failed and Pending.
• Awareness training: the percentage complete, with counts for Overdue and Not Started.

Below the tiles are six cards:

• High-Risk Findings: compliance checks that are failing or in error, with the status, title, integration and due date. The header shows how many are open.
• Compliance by System: each integration with whether it is Passing or Failing and whether it is Connected. The header shows how many are connected.
• People & MFA: how many users have MFA enabled, and the users who don't.
• Asset Health: your assets and their check results.
• Background Checks: the users to look at. The header shows how many need attention.
• Awareness Training: the users who still need to complete training. The header shows how many need attention.

Compliance Checks

The Compliance Checks tab lists the automated checks your connected tools run, and whether each one is passing, failing or in error.

At the top, "Data pulled from:" lists the tools that supply data. Select View more to open a Data Sources window with the full list. Next to it are summary tiles for Compliance checks, Passing, Failing, Error and No data, beside a six-week trend chart.

Find a check

Type in Search compliance checks, or select Filter to narrow the list by:

• All integrations
• All integration connections: Connected, Pending, Disconnected or Error
• All statuses: Passing, Failing or Error
• Check type: All compliance checks or CIS Benchmarks

Read the table

The table has these columns:

• App
• ID
• Integration
• Title
• Status: Passing, Failing, Error or No Data
• Controls and Objectives: what the check is mapped to
• Actions

More rows load as you scroll. No Data means the check hasn't run yet, or the resources it tests don't exist yet in the connected environment. Select What does this mean? beside it to see this tip.

Review the evidence behind a check

1. Go to Monitor › Compliance Checks.
2. In the Actions column, open the Compliance check actions menu for the check.
3. Select View Evidence. A panel opens with two tabs, Scan results and Evidence reports.

Change which controls a check counts toward

1. Go to Monitor › Compliance Checks.
2. Open the Compliance check actions menu for the check.
3. Select Manage Mappings. A panel opens where you can change which controls the check counts toward.

Turn a check off

Use the Enabled / Disabled switch in the Actions column. A disabled check is greyed out and shows no status. The check stays in the list, but it stops counting in your compliance results.

Assets

The Assets tab lists the assets your connected tools found, with the results of the compliance checks run against each one.

Above the table, "Data pulled from:" lists the tools that supply assets. The tiles show Assets, Checks passed, Checks failed, Assets all-clear and Assets with failures, beside a six-week trend chart.

Use Filter to narrow the list by:

• All integrations
• Enable: Enabled or Disabled
• All assets: All Passed or Has Failures

The table has these columns:

• Integration
• Asset Name: select it to open the asset's record in Assets. Going back returns you to this tab.
• Identifier
• Compliance Checks: the number of checks passed and failed. Select it to see the result of each check in a side panel.
• Last Updated
• Last Seen
• Actions

See an asset's extra details

In the Actions column, select Additional Information to open a side panel with the raw details from the tool. It is available when the tool supplies them.

Turn checks off for an asset

1. Go to Monitor › Assets.
2. In the Actions column, switch the asset from Enabled to Disabled.
3. Enter a reason when asked. The reason then shows under the switch.

The asset stays in the list, but its checks stop counting in your compliance results.

Vulnerabilities

The Vulnerabilities tab lists the vulnerabilities your connected tools found on your assets.

The tiles show Vulnerabilities, Critical, High, Open and Remediated, beside a six-week trend chart. Use Filter to narrow the list by:

• All integrations
• All severities: Critical, High, Medium or Low
• All statuses: Open or Remediated

The table has these columns:

• System
• ID
• CVE ID
• Title
• Asset
• Severity
• CVSS
• Status

Rows are for reading only. They don't open a detail page.

User Accounts

The User Accounts tab lists the user accounts your connected tools found, and whether each one has MFA. It helps you spot accounts without MFA and accounts that don't belong to a person in ControlMap.

The "Data pulled from:" strip is hidden when no connected tool supplies user accounts. The tiles are:

• User Accounts
• Orphan Accounts
• MFA Not Enrolled: shown as a percentage
• Admins
• Admins(No MFA)
• Excluded Accounts: select it to open an Excluded user accounts panel that lists the accounts the integration skipped on its last run.

Select any of the first five tiles to filter the list by it.

Find an account

Type in Search user accounts, or select Filter to narrow the list by:

• All integrations
• Orphan account: True or False
• MFA enrolled: True or False
• Administrator: True or False

The table has these columns:

• Integration
• Account: the email and name
• Employee
• Is Admin
• MFA Enforced
• MFA Enrolled
• Account Status: Active or Inactive
• First Seen
• Updated On
• Roles
• Groups

Link an account to an employee

The Employee column links an account to a person in People. An account with no linked employee is an orphan account.

1. Go to Monitor › User Accounts.
2. In the Employee column, select ---Assign--- on the account.
3. Search for the person and select them.

To remove the link, select the × beside the person's name.

Download or attach a user account report

1. Go to Monitor › User Accounts.
2. Select Actions, then choose Download CSV, Download PDF, Attach to evidence or Attach to audit request.
3. In the Select user account report window, choose an integration and a report date.

Select Past reports next to the User accounts heading to see earlier report dates.

Integrations

The Integrations tab is where you connect your tools and manage the connections. See the "Connect an integration" article for the full steps to add one, and to open, run, disconnect or delete a connection.