Skip to content

Coverage

Shows your blind spots.

An alert can only come from a machine that sends its logs. armor360 watches for machines that have gone quiet and helps you fix them.

Start a free pilotSee pricing
From the work to the reportInvestigationsCoverageDetection rulesMonthly security reportAlerts looked into, by weekW1W2W3W494%of machines sending logsNeeds your decisionApprove two quieter rule versionsFix logging on three machinesReview one access exceptionReady to send
Illustrated example with made-up figures: every line of a report traces back to the investigations behind it.

Silence is easy to miss.

A machine that stops sending logs raises no alert. It simply stops being watched.

  • Agents stop

    Collectors crash, get removed or lose their connection, and nothing says so.

  • New machines arrive

    Servers are added faster than collection is set up for them.

  • Half the picture

    A machine may send some logs but not the ones your rules need.

  • Nobody owns it

    Keeping collection healthy falls between the security team and the people who run the machines.

Quiet machines, with their likely cause.

Coverage as a number you can track, and a list of what to fix.

Which machines are being watchedIllustrated example
46/50sending logs
  • web-07 quiet for 2 daysLikely cause: Elastic Agent stopped
  • pos-12 quiet for 6 hoursLikely cause: No route to Fleet
  • hr-files quiet for 1 dayLikely cause: Agent removed in an update
  • build-03 quiet for 3 daysLikely cause: New machine, no agent yet
A machine that stops sending logs raises no alert. armor360 lists the quiet ones with the likely cause, and adds missing Elastic integrations through Fleet once a person confirms.

Machines that went quiet

Each one comes with the likely cause and the steps to fix it, such as checking the machine’s Elastic Agent.

Missing collection, added with Fleet

It suggests the Elastic integrations each machine needs and adds them through Fleet once a person confirms.

Coverage you can measure

See how many of your machines are watched, and which kinds of logs are still missing, so coverage is a number you can track rather than a hope.

How coverage checks work.

  1. 1

    Watch what arrives

    armor360 tracks when each machine last sent logs, and which kinds of logs it sends, across the machines that report to your Elastic deployment.

  2. 2

    Spot the quiet ones

    Machines that have stopped sending logs are listed, each with the likely cause, such as an Elastic Agent that has stopped running or lost its connection.

  3. 3

    Suggest the fix

    For each machine, armor360 suggests the steps to fix it and the Elastic integrations it is missing, written for the person who runs that machine.

  4. 4

    Confirm and add

    Once a person confirms, armor360 adds the missing integrations through Elastic Fleet. The coverage view then shows how many machines are watched and which log types are missing.

Keep every machine in view.

  • Quiet machines

    Machines that stopped sending logs, found for you.

  • Likely cause

    Each silent machine comes with the probable reason.

  • Steps to fix

    Plain instructions for the person who runs the machine.

  • Fleet integrations

    Missing collection added through Elastic Fleet, once confirmed.

  • Log types

    Which kinds of logs each machine sends, and which it does not.

  • Coverage over time

    How many machines are watched, as a number you can track.

Log coverage, by hand and with armor360.

TopicBy hand todayWith armor360
Noticing silenceA machine that stops sending logs raises no alert, so the gap is usually found when someone needs those logs. Machines that went quiet are listed for you, each with the likely cause and the steps to fix it.
Finding the causeSomeone has to log on to the machine or ask its owner to work out why collection stopped. The likely cause comes with each quiet machine, such as checking whether its Elastic Agent is running.
Missing integrationsWorking out which Elastic integrations each kind of machine needs means checking machines one at a time. armor360 suggests the integrations each machine needs, and adds them through Elastic Fleet once a person confirms.
Measuring coverageHow many machines are really watched is an estimate, often based on last month’s list rather than the inventory. The coverage view shows how many machines are watched and which log types are missing, as figures you can track.
Rules and dataRules can look switched on while the logs they depend on have quietly stopped arriving. Quiet machines are listed, so a rule is less likely to sit waiting for data that has stopped.

Frequently asked questions

How does armor360 decide a machine has gone quiet?

It watches when each machine last sent logs, and which kinds, and lists the ones that have fallen silent with the likely cause. You decide which machines matter and who fixes them.

Does armor360 change anything on our machines?

It can add the Elastic integrations a machine needs through Elastic Fleet, and only after a person confirms. Everything else is advice for the people who run the machines.

Read next

More of the platform

See where your team’s time goes. Then decide.

Start a free pilot on your own alerts, or put in your own numbers first.

Start a free pilotRun your numbers