Review Account Status

The ACE OVERVIEW page enables you to more easily manage many accounts from multiple vendors. Identify the accounts to focus on and then view the relevant pages to investigate the issues.

Access the Overview page

To open the Overview page, click the OVERVIEW icon on the left.

By default, the page opens on the Account summary tab and displays an overview of all accounts onboarded to ACE. To learn more about each of the tabs, see Overview page tabs.

Overview page tabs

Use the Accounts, VPCs / VNets, Virtual Machines, Inventory, Assets, and Security controls tabs in combination with the selected entity or account group in the Navigation Tree and filter options for a targeted view of the managed accounts, the protected assets, and the security controls.

The Accounts tab displays an aggregated view of accounts based on your selection in the Navigation Tree and Accounts tab search and filter options. See the table below for a description of the information available in the Accounts tab.

By default, the most risky accounts are listed first. To sort by a different column, click on that column name.

Column Name Description

Account Name

Displays the vendor icon (AWS, Azure, Google Cloud) and name of the account / subscription / project.

Click on an Account Name to navigate to the corresponding VPCs / VNets tab. There, you can review the virtual networks that makes this account risky.

Account ID

The Account ID is the unique ID generated by the vendor that identifies the account / subscription / project.

Hover over the icon to see a popup with the Account ID.

Tip: To copy the Account ID, hover over the icon. In the popup that appears, click Copy.
Virtual Machines at Risk

Displays the number of VMs configured with public IPs and which are associated with rules having critical or high risks based on the activated risk profile.

Click on the number to open the Virtual Machines tab with a detailed view of the specific risky assets.
Internet Access

Shows whether private subnets in the account’s VPCs/VNets have internet access. If at least one VPC/VNet has internet access, the account is classified as Reachable. For a per–VPC/VNet breakdown, click the account name to open the VPCs / VNets tab.

Internet access is determined by running a Traffic Simulation Query in ASMS against all private IP addresses in each VPC/VNet.

Possible values:

  • Reachable: Accounts with Reachable internet status can have one of three states:

    • To & From Internet: At least one VPC / VNet in the account permits some bidirectional traffic between the private subnets that are defined in the VPC / VNet and the internet.

    • From Internet: At least one VPC / VNet in the account permits some traffic from the internet to the private subnets that are defined in the VPC / VNet.

    • To Internet: At least one VPC / VNet in the account permits some traffic to the internet from the private subnets that are defined in the VPC / VNet.

    Tip: Hover over an account with Reachable internet status to see a tooltip with the aggregated number of VPCs / VNets under that account with inbound, outbound, or bidirectional connectivity to the internet.

  • Not found: Of the VPCs / VNets evaluated, Traffic Simulation Query did not find internet access for any of the private subnets defined in the VPC / VNet in the account.

  • Not calculated: Access to the internet was not checked for any of the VPCs / VNets in the account.

    Note:

    • By default, internet access analysis is performed every 2 weeks. Hover over in the column header to see a tooltip with the date and time of the most recent internet access calculation.

    • By default, internet access analysis checks whether the private subnets defined in the VPC / VNet have inbound, outbound, or bidirectional connectivity to the internet address 8.8.8.8 through at least one service. Contact support to change this default.

    • Connections to the internet using public IP addresses are not shown in this column.

    • Google Cloud VPC connectivity to the internet is not calculated.

    • Connectivity analysis is not performed on newly onboarded accounts for the first 24 hours after onboarding, and will appear as Not calculated.

    Tip: To view detailed traffic paths to the internet and the list of allowed ports, use the ASMS Traffic Simulation Query. Set the private subnets as the Source, the internet address as the Destination, and any for the Service. The Traffic Simulation Query result will display the detailed information of the path to the internet.
Public Addresses

Displays the total number of unique public IPs defined under each account / subscription / project.

Hover over the number to display a tooltip with a list of the IPs.

Tip: To copy the full list of public IP addresses to the clipboard, click Copy All.

Note: The tooltip displays up to 25 IP addresses. If there are more, a chip shows the number of additional IP addresses.
Total Risk Triggers

Displays the total number of risk triggers and categorizes them into a bar graph using distinct colors for each severity level:

█ = Critical

█ = High

█ = Medium

█ = Low

Tip: To view detailed information about risks categorized by their specific severity levels, click on the respective colors displayed on the bar graph. Alternatively, to access details regarding all risks, click on the total count. Click on the total number or one of the colors in the bar graph to view the corresponding risks on the Risks page.

Security Rating

Indicates the network security compliance level of the account. For details on how the security rating is calculated, see Calculating the Security Rating.

A color-coded bar beneath the rating gives a visual indication of the level of compliance as follows:

█ 0-50%

█ 51-84%

█ 85-100%

Note: In a situation where data collection was never completed, N/A is displayed.
Trend

Indicates any changes over time in the security rating of the account.

  • The security rating of the account improved during the analyzed period

  • The security rating of the account worsened during the analyzed period

  • No change in the security rating during the analyzed period

  • N/A The trend cannot be calculated (requires at least 2 days of data)

Note: The trend is determined by comparing the current security rating with the rating 30 days prior. If data is unavailable, the rating from the next most recent historical day (for example, day 29) is used.
Unused Rules

Displays the number of rules with no traffic logged during the configured inactivity period.

Click on the number to view details about the unused rules on the Network Policies page.

For details about viewing and managing unused rules see Clean Up Policies.

Security Policies

Displays the number of security policies for each account (not including policies on cloud firewalls).

Click on the number to view details about the policies on the Network Policies page.

Cloud Firewalls

Displays the number of AWS Network Firewalls and Azure Native Firewalls in the account / subscription.

Click on the number to view details about the policies on the Network Policies page.
Issues

If an issue occurred while collecting account data, appears. Hover over the icon to see a tooltip explaining the cause of the issue.

Possible issues include the following:

  • Log collection issues: Usage information may not have been collected on some rules. As a result, the unused rule column information may not be up to date. The issue only impacts the unused rules of the specific account. To investigate the issue further, see details in Last Used column on the Network Policy page.

  • Failure: A general data collection issue occurred potentially affecting all the data displayed for this account. The information displayed represents the most recent successfully collected data. An administrator can investigate further via the Onboarding page.

  • Internal issue: An analysis issue occurred impacting the risk calculations, security rating, and trends data. The displayed information represents the most recent successfully collected data. Contact support.

Accounts tab search and filter options

Use the search and filter fields to see a targeted selection of accounts.

Search Search accounts using partial or whole account names or vendor IDs.
Cloud Type Filter by vendor type(s) (AWS, Azure, Google Cloud).
Accounts Filter by account name(s).
Risk Severity Filter by risk severity (Critical, High, Medium, Low).
Internet Access Filter by internet access (Reachable (to & from internet), Reachable (to internet), Reachable (from internet), Not found, Not calculated).

Customize Columns

You can rearrange columns and toggle their visibility as needed.

Do the following:

  1. Drag column headers to reorder columns.

  2. (Optional) To reset the column order, click , located on the top right of the list of accounts, and then Reset View.

Do the following:

  1. Click , located on the top right of the list of accounts, and then select the columns to show or hide.

    Note: The Account Name column cannot be hidden.

  2. (Optional) To reset the column visibility, click and then Reset View.

The VPCs / VNets tab displays an aggregated view of VPCs and VNets based on your selection in the Navigation Tree and VPCs / VNets tab search and filter options. See the table below for a description of the information available in the VPCs / VNets tab.

By default, the most risky VNets / VPCs are listed first. To sort by a different column, click on that column name.

Column Name Description
VPC / VNet Name

Displays the VPC / VNet icon and name.

ID

The ID is the unique ID generated by the vendor that identifies the VPC / VNet.

Hover over the icon to see a popup with the ID.

Tip: To copy the ID, hover over the icon. In the popup that appears, click Copy.
Cloud Type Displays the icon of the vendor.
Account Name The name of the account where this virtual machine is located.
Virtual Machine at Risk

Displays the number of virtual machines configured with public IPs and which are associated with rules having critical or high risks based on the activated risk profile.

Click on the number to open the Virtual Machines tab with a detailed view of the specific risky virtual machines.
Internet Access

Displays whether or not the private subnets under the VPC / VNet has access to the internet. Internet access is determined by running a Traffic Simulation Query in ASMS against all private IP addresses in each VPC/VNet.

Possible values:

  • Reachable: A VPC / VNet with Reachable internet status can have one of three states:

    • To & from Internet: The private subnets that are defined in the VPC / VNet permit some bidirectional traffic with the internet.

    • From Internet: The private subnets that are defined in the VPC / VNet permit some traffic from the internet.

    • To Internet: The private subnets that are defined in the VPC / VNet permit some traffic to the internet.

    Tip: Hover over a VPC / Net with Reachable internet status to see a tooltip indicating whether the permitted traffic is inbound, outbound, or bidirectional.

  • Not found: Traffic Simulation Query did not find a connection between the private subnets that are defined in the VPC / VNet and the internet. This results either when there is a rule that blocks the VPC / VNet from accessing the internet or no route was found between the VPC / VNet and the internet.

  • Not calculated: VPC / VNet access to the internet was not checked. This can result when the VPC / VNet was onboarded but the internet access analysis did not yet run.

    Note:

    • By default, internet access analysis is performed every 2 weeks. Hover over in the column header to see a tooltip with the date and time of the most recent internet access calculation.

    • By default, internet access analysis checks whether the private subnets defined in the VPC / VNet have inbound, outbound, or bidirectional connectivity to the internet address 8.8.8.8 through at least one service. Contact support to change this default.

    • Connections to the internet using public IP addresses are not shown in this column.

    • Google Cloud VPC connectivity to the internet is not calculated.

    • Connectivity analysis is not performed on VPCs / VNets for the first 24 hours after onboarding, and will appear as Not calculated.

    Tip: To view detailed traffic paths to the internet and the list of allowed ports, use the ASMS Traffic Simulation Query. Set the private subnets as the Source, the internet address as the Destination, and any for the Service. The Traffic Simulation Query result will display the detailed information of the path to the internet.
Public Addresses

Displays the total number of public IPs associated with all interfaces in the virtual network.

Hover over the number to display a tooltip with a list of the IPs.

Tip: To copy the full list of public IP addresses to the clipboard, click Copy All.

Note: The tooltip displays up to 25 IP addresses. If there are more, a chip shows the number of additional IP addresses.
Private Subnets

Displays the total number of private subnets associated with all interfaces in the virtual network.

Hover over the number to display a tooltip with a list of the subnets.

AWS and Azure display additional network information, with AWS showing CIDRs and Azure showing Address Spaces.

Tip: To copy the full list of private subnets to the clipboard, click Copy All.

Note: The tooltip displays up to 25 private subnets. If there are more, a chip shows the number of additional private subnets.
Total Risk Triggers

Displays the total number of risk triggers and categorizes them into a bar graph using distinct colors for each severity level:

█ = Critical

█ = High

█ = Medium

█ = Low

Tip: To view detailed information about risks categorized by their specific severity levels, click on the respective colors displayed on the bar graph. Alternatively, to access details regarding all risks, click on the total count. Click on the total number or one of the colors in the bar graph to view the corresponding risks on the Risks page.

Security Rating

Indicates the network security compliance level of the virtual machine. For details on how the security rating is calculated, see Calculating the Security Rating.

A color-coded bar beneath the rating gives a visual indication of the level of compliance as follows:

█ 0-50%

█ 51-84%

█ 85-100%

Note: In a situation where data collection was never completed, N/A is displayed.
Trend

Indicates any changes over time in the security rating of the virtual machine, as follows:

  • The security rating of the virtual machine improved during the analyzed period.

  • The security rating of the virtual machine worsened during the analyzed period.

  • No change in the security rating during the analyzed period.

  • N/A The trend cannot be calculated (requires at least 2 days of data).

Note: The trend is determined by comparing the current security rating with the rating 30 days prior. If data is unavailable, the rating from the next most recent historical day (for example, day 29) is used.
Unused Rules

Displays the number of rules with no traffic logged during the configured inactivity period.

Click on the number to view details about the unused rules on the Network Policies page.

For details about viewing and managing unused rules see Clean Up Policies.

Security Policies

Displays the number of security policies for each virtual machine (not including policies on cloud firewalls).

Click on the number to view details about the policies on the Network Policies page.

Cloud Firewalls

Displays the number of AWS Network Firewalls and Azure Native Firewalls in each VPC / VNet.

Click on the number to view details about the policies on theNetwork Policies page.
Issues

If an issue occurred while collecting account data, appears. Hover over the icon to see a tooltip explaining the cause of the issue.

Possible issues include the following:

  • Log collection issues: Usage information may not have been collected on some rules. As a result, the unused rule column information may not be up to date. The issue only impacts the unused rules of the specific account. To investigate the issue further, see details in Last Used column on the Network Policy page.

  • Failure: A general data collection issue occurred potentially affecting all the data displayed for this account. The information displayed represents the most recent successfully collected data. An administrator can investigate further via the Onboarding page.

  • Internal issue: An analysis issue occurred impacting the risk calculations, security rating, and trends data. The displayed information represents the most recent successfully collected data. Contact support.

VPCs / VNets tab search and filter options

Use the search and filter fields to see a targeted selection of virtual machines.

Search Search virtual machines using partial or whole account names or vendor IDs.
Cloud Type Filter by vendor type(s) (AWS, Azure, Google Cloud).
Accounts Filter by account name(s).
Risk Severity Filter by risk severity (Critical, High, Medium, Low).
Internet Access Filter by internet access (Reachable (to & from internet), Reachable (to internet), Reachable (from internet), Not found, Not calculated).

Customize Columns

You can rearrange columns and toggle their visibility as needed.

Do the following:

  1. Drag column headers to reorder columns.

  2. (Optional) To reset the column order, click , located on the top right of the list of VPCs / VNETs, and then Reset View.

Do the following:

  1. Click , located on the top right of the list of VPCs / VNETs, and then select the columns to show or hide.

    Note: The VPC/VNet Name column cannot be hidden.

  2. (Optional) To reset the column visibility, click and then Reset View.

The Virtual Machines tab displays an aggregated view of Virtual machines based on your selection in the Navigation Tree and Virtual Machines tab Search and Filter options. See the table below for a description of the information available in the Virtual Machines tab.

*For AWS Instances, Azure VMs, and Google Cloud VM Instances

VM Name

User-defined name of the onboarded Virtual Machine.

Click an VM name to view all associated risk triggers. For more details, see Review Account Status.

VM ID

The VM ID is the unique ID generated by the vendor that identifies the VM. Hover over the icon to see a popup with the VM ID.

Tip: To copy the VM ID, hover over the icon. In the popup that appears, click Copy.
Cloud Type Type of cloud Vendor.
Account Name The Account Name that the VM is part of.
VPC / VNet Name The VPC / VNet Name that the VM is part of.

Status*

Displays the state of the machine:

  • Running: VM operating system and applications are actively running.

  • Not running: VM operating system and applications are not running.

Public Address*

The public address of the Virtual Machine.

When the VM has multiple IP addresses hover over the number to see the additional IP addresses.

Note for Azure:ACE displays the following:

  • Primary and Secondary Public IPs:
    • Static
    • Dynamic (when the VM is running)

Private Address*

The private IP address of the Virutal Machine.

When the VM has multiple IP addresses hover over the number to see the additional IP addresses.

Note for Azure:ACE displays the following:

  • Primary Private IPs:
    • Static
    • Dynamic

Policy Directly Protecting

Displays one of the following:

  • For protected VMs: The column displays the policies protecting the VM. Click on a policy name to view its details. See Manage network policies.

    Tip: AWS and Google Cloud VMs have an automatic default security group assigned if none is selected. In this case, Default is shown for the asset.

  • For unprotected VMs:

    • Unknown is displayed.
Network Risk triggers

The number of risk triggers detected at each severity level associated with this VM. Each severity level has its own color, as follows:

█ = Critical

█ = High

█ = Medium

█ = Low
Application Graph

Displays the name of the application related to the virtual machine as identified by ACE Cloud App Analyzer. If no application is identified, the text Application Graph appears.

Click the text in the column to open the application dependency graph in ACE Cloud App Analyzer showing the applications and component microservices used by the virtual machine.

Note: Application Graph is supported for AWS and Azure virtual machines.

Note: Application Graph is only available with a license for AlgoSec Cloud Enterprise. For details on purchasing a license, see How to Buy a License.
Application Risky Findings (for AWS)

Highlights key security issues related to the virtual machine detected during the ACE Cloud App Analyzer's VM Scan. Icons are enabled in the following cases:

  • Malware: Critical malware findings were detected.

  • Exploitable Vulnerabilities: Critical exploitable vulnerabilities were detected.

  • Open Ports: Open ports were detected.

  • Internet Access: Access to internet was detected.
Tags Any key/value definitions assigned to the VM.

View risk triggers associated with a virtual machine

From the Virtual Machine tab, click a virtual machine name to see a list of all its associated risk triggers as well as details about the VM itself.

Tip: To return to the Virtual Machines tab, click Virtual Machines in the breadcrumbs.

View the following information:

Section Description
Status summary bar Details about the selected virtual machine.
Risk Triggers list

A list of all detected risk triggers associated with the virtual machine.

The tab provides the following information:

  • Severity: Severity level of the risk (critical, high, medium and low).

  • Risk ID: Unique ID number assigned to the detected risk.

  • Risk Title: The name of the risk as it appears in the risks list panel.

  • Policy ID: ID of the policy that triggered the risk.

  • Detection Date: Date that the risk was first detected.

  • Rule ID: Unique ID of the rule in the policy.

    Tip:Click the Rule ID to navigate to the Network Policy page and see the specific rule highlighted in the policy.

  • Description: Description of the risk.

  • Remediation: Suggested course of action to resolve the risk.

Note: The table displays a maximum of 2000 risk triggers.

Virtual Machines tab Search and Filter options

Use the search and filter fields to see a targeted selection of assets.

Search

Search using partial or whole strings on the following information:

  • VM Name

  • VM ID

  • VPC / VNet

  • VPC ID

  • Policy Directly Protecting

  • Private Address

  • Public Address

  • Tags
Cloud Type Filter by cloud vendor type(s).
Accounts Filter Virtual Machine by its Account Name or ID.
Address Type Filter by either Public or Private IPs.
Risk Triggers Severity

Filter by risk severity associated with the Virtual Machine (Critical, High, Medium, Low).

For Azure: select No NSG Detected to display all Virtual Machines with no protecting policy.
Application Risky Findings Filter by application risky findings type (Malware, Exploitable vulnerabilities, Open ports).

Customize Columns

You can rearrange columns and toggle their visibility as needed.

Do the following:

  1. Drag column headers to reorder columns.

  2. (Optional) To reset the column order, click , located on the top right of the list of virtual machines, and then Reset View.

Do the following:

  1. Click , located on the top right of the list of virtual machines, and then select the columns to show or hide.

    Note: The VM Name column cannot be hidden.

  2. (Optional) To reset the column visibility, click and then Reset View.

Export virtual machine report to a CSV file

You can export a report of virtual machine information across all your accounts to a CSV file according to selected entities in the tree and filters (Cloud Type, Account, Address Type, etc.). See each virtual machine’s network details, including IPs, protection policy, tags, network risks, and any detected threats tied to its application.

Do the following:

On the Virtual Machine tab:

  1. (Optional) Customize the report results by using the dropdown filters as needed.

    Note: Text entered into the Search field has no effect on the contents of the CSV file.

  2. Click Export to CSV.

    The Export Report to CSV popup appears.

  3. (Optional) By default, the report name consists of Virtual Machines Report and the date the report was generated. You can enter a new name for the report.

  4. Click Export.

    The report is downloaded to your computer.

    Note:

    • Only one report can be generated at a time.

    • Report generation can take up to 20 minutes.

    • If report generation fails, you will need to wait up to 20 minutes before trying again.

The Inventory tab displays an overview of the selected Assets and Security Controls based on your selection in the Navigation Tree. See the table below for a description of the information available in the Inventory tab.

Inventory resource types

Your ACE inventory is organized into the following resource types:

Assets

AWS

  • Accounts

  • VPCs

  • Subnets

  • Instances

  • S3 Buckets

Azure

  • Subscriptions

  • VNets

  • Subnets

  • VMs

  • Virtual Hubs

  • Storages

Google Cloud

  • Projects

  • VPC networks

  • Subnets

  • VM Instances

  • Cloud storages

Security controls

Includes the following types of security controls:

  • AWS SGs (Security Groups)
  • Azure
    • Azure NSGs (Network Security Groups)
    • Azure Native Firewalls (Managed with Policies) and the Azure Native Firewall Policies
    • Azure Firewall (classic) rule-based
  • Google Cloud Firewall

Note: The assets displayed in the Inventory tab is a partial selection highlighting the most important assets. For a comprehensive list of all assets, along with detailed information about each, please refer to the Assets tab.

The Assets tab displays an aggregated view of assets based on your selection in the Navigation Tree and Assets tab Search and Filter options. See the table below for a description of the information available in the Assets tab.

*For AWS Instances, Azure VMs, and Google Cloud VM Instances
Type Type of cloud asset.

Asset Name

User-defined name of the onboarded asset.

Click an asset name to view element details. See View Element Details.

Element ID

The Element ID is the unique ID generated by the vendor that identifies the element. Hover over the icon to see a popup with the Element ID.

Tip: To copy the Element ID, hover over the icon. In the popup that appears, click Copy.

Assets tab Search and Filter options

Use the search and filter fields to see a targeted selection of assets.

Search Search accounts using partial or whole asset or policies names.
Cloud Type Filter by cloud vendor type(s).
Asset Type Filter by asset type(s).

Customize Columns

You can rearrange columns and toggle their visibility as needed.

Do the following:

  1. Drag column headers to reorder columns.

  2. (Optional) To reset the column order, click , located on the top right of the list of assets, and then Reset View.

Do the following:

  1. Click , located on the top right of the list of assets, and then select the columns to show or hide.

    Note: The Type column cannot be hidden.

  2. (Optional) To reset the column visibility, click and then Reset View.

The Security controls tab displays a detailed list of the relevant security controls based on your selection in the Navigation Tree.

Customize Columns

You can rearrange columns and toggle their visibility as needed.

Do the following:

  1. Drag column headers to reorder columns.

  2. (Optional) To reset the column order, click , located on the top right of the list of security controls, and then Reset View.

Do the following:

  1. Click , located on the top right of the list of security controls, and then select the columns to show or hide.

    Note: The Type column cannot be hidden.

  2. (Optional) To reset the column visibility, click and then Reset View.

View Element Details

In the Assets and Security Controls tabs, you can click on the name of the asset or security control to display the Element Details window.

 

â See also: