Documentation
Dashboard and alerts
The posture score, findings and their triage, what gets flagged for attention, and reports.
The overview page
The first page after sign-in summarises your organisation's security posture and refreshes every 10 seconds.
| Card | What it shows |
|---|---|
| Posture score | A score out of 100 based on your open findings and their severity. Higher is better. |
| Open vulnerabilities | Open findings counted on the dashboard, with how many are resolved and how many fall below your severity floor. |
| Mean time to remediate | The average time from a finding being opened to being closed, across closed findings. |
| Last scan | How long ago the most recent scan ran. |
| Severity breakdown and trend | Open findings by severity, and how the picture has changed over time. |
Admins set the lowest severity that counts (the severity floor) under Settings → System. Findings below it stay visible but are greyed out and left out of the score and reports.
What gets flagged for attention
Holistra raises these in the dashboard itself:
| Alert | Where | What to do |
|---|---|---|
| Known-exploited vulnerabilities | Red banner on the overview, with how many are used in ransomware campaigns | Fix these first. They are listed in the CISA KEV catalogue as exploited in the wild. |
| Agents waiting for approval | Banner on the overview and a count on Agents in the sidebar (Admins and Security Engineers) | Approve agents you recognise; delete the rest and consider rotating the enrolment token. |
| Posture issues | Badge on each agent with failing checks, and findings on the host | Open the device page for the failing checks and fix guidance. |
| Attack-surface drift | Findings on the host, when drift findings are on | Confirm the change was expected and mark it so, or investigate. |
| Updates available | Update now on outdated agents; pending threat-intelligence updates in Settings | Update agents, or let the automatic policy do it. |
Findings
Every scan, agent inventory, posture check and compliance check produces findings. The Findings page groups them by scan with a severity breakdown; each finding has a detail page with its evidence, remediation advice and, where it has a CVE, its KEV and EPSS context.
Severity and prioritisation
- Severity (Critical, High, Medium, Low, Info) comes from the scanner or from the CVE's CVSS score, and can be adjusted during triage.
- KEV marks vulnerabilities known to be exploited in the wild, and whether they are used by ransomware.
- EPSS estimates how likely a vulnerability is to be exploited in the next 30 days.
Triage
Admins and Security Engineers can move a finding through these statuses:
| Status | Meaning |
|---|---|
| New | Not yet looked at. |
| In-Progress | Someone is working on it. |
| Closed | Fixed. Agent findings close by themselves once a later report shows the fix, and reopen if the problem comes back. |
| False Positive | Not a real issue. Automatic checks leave it alone. |
Retest on a finding re-runs the check that found it. Remediate sends a fix script to the agents on the affected hosts (see Remediation scripts).
Assets
The Assets page lists everything that has been scanned or reported by an agent, one row per host. You can set each asset's type, owner and tags, select several to tag, run a script on or remove them, and export the list as CSV. Assets an agent no longer reports are marked Stale; Admins can have stale assets removed automatically after 7, 30 or 90 days.
Compliance
Compliance runs baselines of checks on your hosts through their agents: a Holistra essentials baseline, and macOS baselines from the NIST macOS Security Compliance Project (such as CIS Level 1 and 2). Assign a baseline to all agents, a platform, a tag or chosen hosts, and run it by hand, daily or weekly.
- Overview: the organisation's score and each baseline's score and trend, with the least compliant hosts and most failed checks.
- Assets: every host's score, and each check's latest result with evidence. Fix on a failing check opens the remediation dialog on the matching library fix.
- Runs: live progress per host, and which hosts were skipped and why.
A host's score is the share of checks that passed, counting each check's latest result.
Reports and exports
- Reports: a PDF report per scan, and the organisation's compliance report as PDF or CSV, with a per-host CSV.
- Assets: CSV export of the filtered list.
- Audit log (Admins and Auditors): every change made by a signed-in user, exportable as CSV, with a Verify integrity check that detects edited or missing entries.