Configure entity posture

Entity Posture in Exposure Analytics uses metrics to proactively identify security control gaps across assets and users. These metrics help organizations monitor and strengthen their overall security posture. For example, metrics can reveal gaps in asset management or vulnerability scanning, as well as show whether users have completed required security tasks, such as awareness training.

Each entity posture metric assesses a defined group of assets or users using data from selected sources or specified logic. It identifies the entities in scope, those that do not meet the metric requirements and are therefore considered gaps, and those that meet the requirements and are compliant.

Examples of entity posture metrics might include:

  • Asset management: Identify the assets that are not managed.

  • Vulnerability scanning: Identify the assets that have not been vulnerability scanned.

  • Security awareness: Identify the users that have not completed security awareness training.

Exposure Analytics includes predefined entity posture metrics that can be quickly added and cover common security controls. These are driven by suitable entity discovery sources. For example, an entity discovery source related to endpoint security is required for the endpoint security metric to report on endpoint security gaps.

The following table details the available predefined metrics:

Metric Metric type

Asset Management

Asset

Endpoint Security

Asset

Full Disk Encryption

Asset

Log Collection

Asset

Patch Management

Asset

Secure Configuration

Asset

Vulnerability Scanning

Asset

Legacy Operating System

Asset

Default Users

User

Security awareness

User

You can create additional entity posture metrics to report control gaps that are specific to your organization and that you have the relevant data for.

The table below outlines the steps to configure entity posture.

Note: You must configure entity discovery first, before configuring entity posture.
Step setup task Description Documentation

1

(Required) Configure entity posture metrics

Add entity posture metrics. You can select from predefined metrics, or add your own additional metrics.

Add an entity posture metric
2

(Optional)

Edit the metrics

 Modify logic or exceptions for the metric. Edit an entity posture metric

3

(Optional)

Adjust posture metric thresholds

Adjust posture metric compliance color thresholds from their default values.

Additional entity posture configuration

4

(Optional)

Select posture metrics for Entity analysis overview

Show all metrics or only metrics with gaps on the Entity analysis overview tab.