Docs menu ▾
Using the dashboard
The dashboard at https://genossec.com/dashboard/ answers three questions: is every server still enforcing, did anything get blocked, and is anything suspicious? It is read-only. Nothing you do there changes a server.
Colors
The same colors mean the same thing everywhere:
| Color | Means | Examples |
|---|---|---|
| Green | Healthy | Reporting, Enforcing, Verified |
| Red | Needs attention now | Silent, Off, Mismatch, DENY |
| Orange | Worth a look | Denied-write counts and charts, Unverified baselines |
| Grey | No data yet | No baseline, Never reported |
Hover over most labels for a one-line explanation.
Layout
- Sidebar: the pages, plus every node with a status dot (green reporting, red silent).
- Top bar: the whole fleet's state: All reporting, or how many nodes are silent.
- Pages: a title and status badge, then summary cards, then detail tables.
The Overview and Alerts pages refresh themselves every 30 seconds.
Overview
The page to keep open.
| Section | Shows |
|---|---|
| Enforcing | Nodes enforcing right now out of all nodes. The ring turns orange when any node isn't |
| Silent nodes | Nodes that missed three heartbeats in a row. Click to see them |
| Denied · 24h | Writes blocked across the fleet in the last day, with a mini chart |
| Alerts · 24h | Alerts in the last day, and how many nodes have hash drift |
| Denied writes chart | Blocked writes per hour across all nodes |
| Recent alerts | The newest alerts. View all opens the Alerts page |
| Nodes table | One row per node: status, enforcement, last heartbeat, versions and hashes, live grants, blocked writes, baseline trust. Silent rows are red |
| Install baselines | Every baseline the scanner uploaded, including hosts whose daemon hasn't enrolled yet, plus failed scans |
Node pages
Click a node anywhere to open it. It has three tabs.
Posture
The node's latest heartbeat:
- Cards: last heartbeat (and when it'll turn red), enforcement on/off with hook count, live grants, decisions in the last 24 hours.
- Integrity: the scanner, bundle and policy hashes the node reports. If you've set expected values on the server, each is labeled Expected or Drift. The baseline row shows whether the daemon is enforcing the baseline the scanner uploaded.
- Host: kernel, boot ID, daemon uptime, protected directory and its inode, attached hooks.
- Daemon lifecycle: each time the daemon started. More than one start means it was stopped or crashed in between.
- Recent alerts for this node, and the raw heartbeat JSON.
Decision log
Every ALLOW and DENY the enforcer reported:
- Filters: time range (24h, 7d, 30d), decision, action (
create,rename,link,open), user ID and directory inode. Press Apply filters. - Chart: blocked writes over the chosen range.
- Table: newest first, 100 per page. Observed is when it happened on the host; Received is when the server got it.
Baseline
What the scanner recorded at install:
- Trust: whether the daemon's signed heartbeat confirms this baseline (see below).
- Entities: how many, grouped by kind and by threat family.
- Coverage: probe problems during the scan. Non-zero counts mean parts of the host couldn't be read.
- Identity: the hashes, the scanner build, and where the upload came from.
- Entities table: the first 50 entities, and the full scan profile as JSON.
Baseline trust labels
| Label | Meaning | Do |
|---|---|---|
| Verified | The daemon's signed heartbeat reports the same hashes as the upload | Nothing |
| Unverified | Uploaded, but no heartbeat has confirmed it yet | Wait for the daemon's first heartbeat |
| Awaiting daemon | Uploaded, and this host's daemon hasn't enrolled | Enroll the daemon |
| Mismatch | The daemon enforces a different baseline than the one uploaded | Investigate. See Alerts |
| No baseline | The scanner never uploaded one for this hostname | Expected today; see Quickstart known gaps |
Alerts page
- Silent right now: nodes past three missed heartbeats, with how long they've been quiet. This list is live and empties when they return.
- Alert history: the last 30 days, filterable by kind. Repeats within an hour add to Count instead of adding rows.
What each alert means and what to do: Alerts.
Tickets page
When a node blocks a file that isn't in its baseline, the server opens a ticket so you can approve the change if it's expected. One ticket per file per host; repeated attempts raise its Tries count.
- Status filter: open, approved, expired, dismissed, or all. Open tickets come first.
- Approve: pick a grant length (2–15 minutes) and approve. The server signs the approval; the node's daemon pulls it on its next poll, verifies the signature, and allows that one file for that window. Nothing else opens, and the server never connects to the node.
- Revoke / dismiss: dismiss an open ticket you don't want approved, or revoke one you approved.
- Expired: an approval's window passed. If the node blocks the file again, the ticket reopens.
- Approver key: the panel at the top shows the public key to install on each host as
/etc/genos/approver-ed25519.pub. Without it, a daemon rejects every approval.
A ticket is for an expected change you want to allow. An alert is for something wrong. A blocked file shows up as both: a DENY in the decision log and a ticket to act on.
Catalog page
The threat catalog that scanners download, with its fingerprint, its SHA-256, and the two lines to put on a host so the scanner fetches it from genossec.com. See Node setup.
Signing in and out
Sign-in goes through Clerk. Only allowlisted accounts get in. A session lasts 8 hours. Sign out ends both your dashboard session and your Clerk session.