Skip to content
GT Arsenals Docs

Security Overview

Security Overview (Security → Security Overview) is a posture summary for one organization, built only from events and settings Guardian actually records. It is available to Superadmins; other roles don’t see it in the menu and the underlying request is refused.

If you manage several organizations, select one first — a combined view across organizations is not offered here.

Findings

Section titled “Findings”

The top of the page lists what needs attention, most serious first. Each finding opens the screen where you can act on it:

Finding Raised when Opens
Users with no second factor Any active user has neither an authenticator app (TOTP) nor a registered passkey. High severity when fewer than half of your users are protected. Users
Failed sign-ins Five or more in 24 hours (high at 20 or more). Names the account that was targeted most. Audit Log
USB intrusion / configuration drift Any such event recorded in the last 7 days. Audit Log
Failing compliance checks Any check failing on any of your agents. Compliance
Agents not seen for 7 days An agent hasn’t reported for over a week — a monitoring gap. Agents (filtered to offline)

If none of these apply, the page says Nothing to flag — which means the measured signals are below their thresholds, not that your environment is proven secure.

The numbers

Section titled “The numbers”

Four tiles summarize MFA coverage, failed sign-ins (24 hours and 7 days), privileged changes in the last 7 days (user create/update/delete, settings changes, approving or dismissing actions) and non-compliant agents. Below them, Recent security-relevant activity lists the latest sign-in failures, security events and privileged changes with who, what, from which address, and when.

The page refreshes every minute. If a refresh fails it keeps showing the last data and tells you how old it is.

What this view does not measure

Section titled “What this view does not measure”

Guardian prints this on the page too, so it is never mistaken for something it isn’t:

  • Failed sign-ins are counted only for usernames that belong to your organization. Attempts against usernames that don’t exist can’t be attributed to any organization and are not counted.
  • It does not include endpoint detection, file-integrity monitoring or vulnerability scanning.
  • Security events are limited to the audit actions Guardian records.
Section titled “Related”