9d0e4b910e
New features: - Granite supplemental workbook ingest with reconciliation - Drag-fill and bulk default cascade in Granite Loader - OS type searchable dropdown in Granite Loader - Persist selections across pages + Select All - NetBox badge on Reporting page with CARD cross-check - CARD API connection retry for DNS round-robin dead nodes - Granite Loader export to supplemental hygiene section Fixes: - Compliance reconcile stale core columns (type field vs string matching) - Compliance upload case-insensitive column matching - Compliance summary query NULL vertical handling - Compliance page state persistence across uploads - TLS for GitLab feedback integration after v19 upgrade Also: updated user guide with all new features, added release comms template.
32 KiB
AEGIS Security Dashboard — User Guide
This guide covers everything you need to operate the AEGIS Security Dashboard as a security engineer. It walks through daily workflows — from CVE triage and compliance monitoring to Jira ticket management and exception handling — organized by the pages you interact with.
Table of Contents
- Getting Started
- Home Page
- Vuln Triage — Reporting Page
- Compliance Page
- CCP Metrics
- Knowledge Base
- Exports
- Granite Loader
- Jira Tickets
- Archer Templates
- User Settings
- Admin Features
- Tips and Best Practices
- Feedback and Bug Reports
Getting Started
Logging In
Open the dashboard in your browser. You will see the login screen with the AEGIS branding. Enter the username and password provided by your administrator.
- Sessions last 24 hours. After that, you will be prompted to log in again.
- If you enter incorrect credentials too many times in a short window, the account is temporarily locked. Wait 15 minutes or contact your admin.
After a successful login, the dashboard loads directly to the Home page.
Navigation
The left-side navigation drawer lists every page available to you. Pages you cannot access based on your group assignment do not appear in the drawer — you will only see what is relevant to your role.
The navigation drawer includes:
- Home — CVE management and quick lookup
- Vuln Triage — Ivanti host finding reporting and triage
- Compliance — AEO compliance posture monitoring
- CCP Metrics — cross-vertical VCL reporting (Leadership and Admin only)
- Knowledge Base — internal documentation library
- Exports — pre-built data export cards
- Jira Tickets — ticket management (Standard_User and Admin only)
- Archer Templates — risk acceptance form templates (Standard_User and Admin only)
- Admin — user management, audit log, system tools (Admin only)
The top-right corner shows a notification bell (unread count badge) and your user menu with access to profile settings and logout.
Understanding Your Role and Team
Your experience in the dashboard depends on two things: your group and your team assignment.
Groups determine which pages you can see:
| Group | Access Level |
|---|---|
| Admin | All pages, all data, user management, audit log |
| Standard_User | Home, Vuln Triage, Compliance, Knowledge Base, Exports, Jira, Archer Templates |
| Leadership | Home, Vuln Triage, Compliance, CCP Metrics, Knowledge Base, Exports |
| Read_Only | Home, Knowledge Base |
Team assignment determines which data you see. You only see findings, compliance items, and asset data belonging to your assigned business unit(s). If you expect to see data that is not appearing, contact your administrator to verify your team assignment.
Note: Admin users bypass team scoping and can view all data across all teams.
Home Page
The Home page is your starting point. It provides quick CVE lookup, recent activity, calendar tracking, and summary panels for open tickets.
CVE Lookup and Search
The center panel contains the Quick CVE Lookup field. Type a CVE identifier (e.g., CVE-2024-12345) and the dashboard queries the National Vulnerability Database to auto-populate severity, description, and publication date.
Below the lookup is the CVE list — a searchable, filterable table of all tracked CVEs. You can:
- Search by CVE ID, vendor name, or free text
- Filter by vendor, severity, or status
- Expand a CVE entry to view full details, linked vendor entries, and uploaded documents
- Create a new CVE record (Standard_User and above)
- Upload documents (advisories, patch notes, screenshots) linked to a specific CVE/vendor pair
Each CVE entry shows its severity badge, vendor count, and document count at a glance. Expanding it reveals the full description, linked Archer tickets, and associated Jira tickets.
Note: Read_Only users can view and search CVEs but cannot create, edit, or upload.
Recent Activity
The Recent Activity feed on the Home page shows a chronological list of recent actions — new CVE entries, document uploads, compliance uploads, and other events. This gives you situational awareness of what your teammates are working on.
Note: Administrative system events (sync completions, scheduled jobs) are hidden from non-Admin users to reduce noise.
Calendar Widget
The right-side panel includes a Calendar Widget that highlights dates with SLA deadlines or scheduled actions. Current day is visually highlighted. Dates with activity show indicator dots.
Tickets and Archer Panel
The right panel also shows a compact list of Open Tickets — Jira tickets and Archer exceptions currently tracked in the dashboard. Each entry shows the ticket key, status badge, and summary. This gives you a quick count of outstanding items without navigating to the dedicated Jira or Archer pages.
Ivanti Counts Panel
A summary card displays current open and closed finding counts from the most recent Ivanti sync. This provides an at-a-glance view of your team's vulnerability posture without needing to open the full Reporting page.
Vuln Triage — Reporting Page
The Reporting page is where you spend most of your triage time. It displays all synced Ivanti host findings for your assigned team(s), with tools for filtering, annotating, and routing findings to the appropriate workflow.
Note: Available to Admin, Standard_User, and Leadership groups.
Findings Table
The main table shows one row per host finding. Each row displays:
- Hostname and IP address (with IPv6 fallback badges where applicable)
- Severity — numeric VRR score with color-coded badge (Critical, High, Medium, Low)
- VRR Group — severity classification
- Status — Open, Closed, or archived state
- SLA Status — whether the finding is within or overdue on its remediation SLA
- BU — the business unit the finding belongs to
- FQDN — fully qualified domain name
- Atlas badge — indicates whether an Atlas action plan exists for this host
- NetBox badge — indicates whether the device has a record in NetBox (sky-blue = found, dim = not found)
- Notes — any annotations you or your team have added
Group by Host — toggle this option to collapse findings that share the same hostname and IP into expandable groups. This reduces visual clutter when a single host has many findings.
IPv6 badges — some findings lack an IPv4 address. These show an amber "Q" badge (Qualys IPv6) or an indigo "v6" badge (primary IPv6) depending on which fallback address was captured.
Filtering and Search
The toolbar above the table provides multiple filtering options:
- Free-text search — filters across hostname, IP, FQDN, CVE titles, and notes
- Column filters — click a column header to filter by specific values within that column
- Severity sort — sort ascending or descending by VRR score
- BU picker — multi-select to scope the view to one or more business units (within your team assignment)
- Status filter — show only Open, only Closed, or all findings
Filters are composable — apply multiple at once to narrow down your working set.
Inline Editing and Overrides
For any finding you have write access to:
- Override hostname — if the synced hostname is incorrect or needs clarification, click the hostname field to edit it inline. Your override persists across syncs.
- Override DNS — similarly, the DNS/FQDN field can be overridden locally without affecting the upstream Ivanti record.
Overrides are visual cues for your team's context — they do not modify the source system.
Notes
Click the notes cell on any finding row to add or edit a note. Notes are free-text annotations visible to anyone on your team who views the same finding. Use them to record triage decisions, remediation context, or handoff information.
Bulk Actions and Queue Staging
Select one or more findings using the row checkboxes. The bulk action toolbar appears at the top of the table with options to:
- Add to Queue — stage selected findings in your personal Ivanti Queue for batch workflow processing
- Export Selected — export only the selected rows to CSV or XLSX
When adding to the queue, you choose the workflow type: FP (False Positive), Archer (Risk Acceptance), CARD (Ownership), GRANITE (Loader Sheet), DECOM (Decommission), or Remediate.
The toolbar remains visible as you scroll through the findings list.
Selection persistence — your row selections persist as you page through the findings table. If you select 5 items on page 1, navigate to page 2, and select 3 more, all 8 remain selected. The Select All button at the top of the checkbox column selects every row on the current page in one click. Combined with persistent selections, this makes it easy to build large working sets across multiple pages without losing your picks.
FP Workflow Submission
After staging findings in the queue with the FP workflow type, navigate to the Ivanti Queue page (accessible from the nav drawer under Vuln Triage). From there:
- Select one or more FP queue items
- Click Submit FP Workflow
- Attach supporting documentation (10 MB per file limit)
- Set the expiration date, scope override, and reason
- Submit — the workflow is sent directly to Ivanti
Lifecycle tracking — submitted workflows move through states: Submitted, Approved, Rejected, Rework, Resubmitted. You can view your submission history in a collapsible panel. If a workflow is rejected, you can edit the justification and resubmit, or re-queue the finding for a different approach.
Approved submissions auto-clear. Rejected submissions can be dismissed or acted upon.
CARD Ownership Lookup
Hover over an IP address in the findings table to see a CARD ownership tooltip. The tooltip shows the confirmed owner team, unconfirmed candidates, and candidate scores from the CARD asset management system.
For deeper investigation, click the IP to open the CARD Detail Modal where you can:
- View the full asset record (NCIM, Qualys, Netops Granite data)
- Confirm ownership (assigns the asset to your team)
- Decline ownership (removes your team from the confirmed slot)
- Redirect ownership to another team
Note: CARD actions require Standard_User or Admin group.
Atlas Badges
Findings with an associated Atlas action plan display a small badge on their row. Click the badge to open the Atlas Slide-Out Panel showing the plan type (remediation, risk acceptance, or compensating control), associated vulnerabilities, and plan metadata.
You can create new action plans or update existing ones from this panel if you have write access.
NetBox Badge
Each finding row displays a NetBox badge next to the hostname. The badge indicates whether the device has a record in NetBox (the network infrastructure source of truth).
- Sky-blue badge with site code — device found in NetBox. Hover or click to see a tooltip with device details: status, site/location, role, device type, manufacturer, platform, tenant, and serial number.
- Dim dash badge — device not found in NetBox.
- Spinning loader — lookup in progress (first load only, then cached for the session).
The tooltip also performs a CARD/NetBox cross-check — if the CARD hostname and NetBox device name don't match, an amber mismatch warning appears at the bottom of the tooltip. This helps catch stale or inconsistent records across systems.
NetBox lookups are cached per-session so repeated views of the same findings don't generate additional API calls.
Export
The Export button in the toolbar exports the current filtered view to CSV or XLSX format. The exported file reflects exactly what you see on screen — all active filters, sorting, and column selections are preserved in the output.
Compliance Page
The Compliance page tracks your team's AEO compliance posture — non-compliant devices, metric health, and remediation progress over time.
Note: Available to Admin, Standard_User, and Leadership groups.
Team Selector
At the top of the page, the Team selector lets you switch between teams you have access to (STEAM, ACCESS-ENG). The page reloads to show compliance data for the selected team.
Note: Admin users can view all teams. Non-admin users only see teams matching their assignment.
Metric Health Cards
Below the team selector, a row of metric health cards summarizes each compliance metric's current status. Each card shows:
- Metric name
- Pass/fail indicator (green check or red warning)
- Count of non-compliant devices
- Trend direction (improving, stable, or degrading)
- Estimated resolution date (if set)
Cards with failing metrics are visually highlighted to draw your attention to areas that need remediation effort.
Device List
Clicking a metric health card opens the device list — a table of all devices that are non-compliant for that specific metric. Each row shows the hostname, violation details, how long it has been non-compliant (recurrence tracking), and any associated notes.
Detail Panel and Notes
Selecting a device from the list opens the Detail Panel on the right side. This panel shows:
- Full violation history for that hostname/metric pair
- Notes — add per-device context, remediation steps, or ownership information
- Compliance history across uploads (when the item first appeared, if it was ever resolved, and if it recurred)
Notes support a group ID for batch operations — you can tag multiple notes with the same identifier for bulk reference.
Remediation Planning
From the Compliance page you can generate Granite Loader Sheets directly for non-compliant devices. Select devices and click Generate Granite Loader to create a sheet enriched with CARD asset data, ready for remediation tracking.
The page also displays compliance trend charts showing improvement or degradation over time for each metric.
Upload Process
Note: Compliance uploads require Standard_User or Admin group.
To upload new weekly compliance data:
- Click the Upload button at the top of the Compliance page
- Select your team's weekly compliance xlsx file (up to 100 MB)
- The system parses the spreadsheet and presents a diff preview — showing new non-compliant items, resolved items, and recurring items
- Review the diff and confirm the upload
- Metric health cards and the device list update immediately
The upload is additive — it does not delete previous history. Each upload is tracked with a timestamp so you can see progression over time.
CCP Metrics
The CCP Metrics page provides executive-level visibility into VCL (Vulnerability Compliance Level) posture across multiple verticals and teams.
Note: Available to Admin and Leadership groups only.
Multi-Vertical Overview
The overview page shows all tracked verticals with aggregated compliance statistics. Each vertical card displays:
- Vertical name and team assignment
- Compliant vs. total device counts
- Non-compliant count (clickable for metric breakdown)
- Data freshness badges — LIVE (current report) or LAST REPORT (historical)
VCL Stats and Trend Charts
For each vertical, trend charts show:
- Compliance percentage over time
- Per-metric breakdown of non-compliant items
- Aggregated burndown forecast — projected date when all items reach compliance based on current velocity
Drill-Down and Forecasting
Click a vertical to drill down into:
- Sub-team breakdowns — intermediate view showing per-team compliance within the vertical
- Per-metric forecast burndown chart — visual projection of remediation timelines per metric
- Metric summary cards — compliant/total counts with remediation plan indicators
- Device metadata — asset-level context for non-compliant items
The Exec Report page provides an exportable summary suitable for leadership reporting.
Note: Data management (delete vertical, rollback upload, reset all) is Admin-only.
Knowledge Base
The Knowledge Base is an internal document library for policies, guides, reference material, and operational documentation.
Available to all authenticated users.
Capabilities:
- Browse articles organized by category
- Search by title, content, or category
- View documents inline — PDFs render in the browser, Markdown articles display formatted content
- Download documents in their original format (PDF, Word, Excel)
- Upload new articles or documents (Standard_User and above)
Categories help organize content by topic — use them to find security policies, triage playbooks, operational guides, or vendor advisories.
Exports
The Exports page provides pre-built export cards for common data pulls. Each card represents a specific dataset you can export with one click.
Available exports include:
- Jira Tickets — all tracked tickets in CSV or XLSX format
- CCP Metrics — VCL compliance data for reporting
- Remediation Status — current remediation state across teams
- Findings — filtered Ivanti findings data
- Granite Loader Sheets — formatted spreadsheets with CARD enrichment for asset remediation workflows
Select a card, choose your format (CSV or XLSX), and the download starts immediately. Export content reflects the current state of the data at the time you generate it.
Note: Available to Admin, Standard_User, and Leadership groups.
Granite Loader
The Granite Loader generates formatted Granite Loader Sheets for asset remediation workflows. It takes device data from your findings or compliance items, enriches it with CARD asset information, and produces a structured spreadsheet ready for submission.
Note: Available to Admin and Standard_User groups.
Opening the Loader
You can open the Granite Loader from two places:
- Ivanti Queue — select queue items with the GRANITE workflow type and click Generate Granite Loader
- Compliance page — select non-compliant devices and click Generate Granite Loader from the Remediation Planning section
The Loader opens as a full-screen modal showing your selected devices in a spreadsheet-style grid.
Column Selection and Operation Type
At the top of the Loader, choose your Operation Type (Change, Add, or Delete) — this determines which columns are required for a valid submission.
Below that, select which columns to include in your output. Columns are grouped by category (Core, Location, UDA, Other). Required columns for your chosen operation type are pre-selected and cannot be deselected.
Editing Cells
Click any cell to edit its value inline. The cell enters edit mode with a text input — type your value and press Enter or click away to commit. A small "x" icon appears on overridden cells to let you clear the override and revert to the original device value or bulk default.
The value resolution order is: your override > bulk default > enriched device value > empty. This means bulk defaults fill in gaps automatically, but any cell you explicitly edit takes priority.
Drag-Fill
The Granite Loader supports drag-fill — similar to Excel's fill-down behavior. When a cell has a value, grab the small square handle at the bottom-right corner of the cell and drag downward. All cells you drag across will be filled with the source cell's value.
This is useful for applying the same site code, team name, or status across a range of rows without editing each one individually.
Bulk Defaults
Above the data grid, the Bulk Defaults row lets you set a default value for any column. Type a value into the bulk default cell for a column and it automatically applies to every row that doesn't have an explicit override.
Use bulk defaults when most rows share the same value for a field (e.g., the same RESPONSIBLE_TEAM or EQUIP_STATUS) — set it once at the top and only override the exceptions.
Cascade behavior — when you set a bulk default, it immediately fills all empty cells in that column. Rows you have already edited retain their overrides.
OS Type Picker
The OSTYPE column uses a searchable dropdown instead of free-text input. Click the cell and a filterable list appears with all recognized operating system types (Windows, RHEL, Cisco IOS, VMware ESXi, and dozens more).
Type to filter the list, then click to select. This ensures consistent OS type values across all Granite submissions and eliminates typos or naming variations.
Selection Persistence and Select All
When the Loader contains more devices than fit on a single page, your row selections persist as you navigate between pages. Check rows on page 1, move to page 2, check more — all selections are maintained.
The Select All checkbox at the top of the selection column selects every row on the current page. Combined with persistent selections, you can quickly select large batches across multiple pages.
Supplemental Workbook Ingest
The Granite Loader includes a Supplemental Hygiene section for importing supplemental workbook data. This allows you to upload an existing supplemental hygiene spreadsheet and reconcile it against the devices already in the Loader.
To use supplemental ingest:
- Click the Supplemental tab or section within the Granite Loader view
- Click Upload and select your supplemental hygiene xlsx file
- The system parses the spreadsheet and presents a reconciliation preview — showing which devices match, which are new, and which have conflicting data
- Confirm the import to merge the supplemental data into your current Loader session
This eliminates the need to manually cross-reference between the Loader output and existing supplemental records. The reconciliation flags discrepancies so you can resolve them before generating your final sheet.
Export and Download
When your sheet is ready, click Export to generate the final xlsx file. The export includes only selected columns, applies all overrides and bulk defaults, and formats the output in the Granite-expected structure.
The exported file downloads immediately to your browser. It is ready for submission to the Granite system without further editing.
Jira Tickets
The dedicated Jira Tickets page lets you create, view, and sync tickets linked to your vulnerability management workflows.
Note: Available to Admin and Standard_User groups only.
Viewing tickets:
- The page shows all locally tracked Jira tickets with their key, summary, status, and linked CVE/vendor pair (if applicable)
- Status values display as received from Jira — no mapping or translation
Creating tickets:
- Click Create Ticket to open the creation form
- Fill in the summary, description, and optionally link to a CVE/vendor pair
- Select the project and issue type (vendor-specific projects and issue types are available)
- The ticket is created in Jira and tracked locally in the dashboard
Multi-item tickets:
- From the Ivanti Queue, you can select multiple queue items and create a consolidated Jira ticket covering all of them
- The Consolidation Modal lets you review and adjust the combined ticket before submission
Lookup and sync:
- Use JQL Lookup to search for existing Jira tickets that match criteria
- Results can be saved to the dashboard using Save to Dashboard for ongoing tracking
Archer Templates
The Archer Templates page manages reusable template content for Archer Risk Acceptance forms.
Note: Available to Admin and Standard_User groups only.
Templates are organized by Vendor, Platform, and Model in a hierarchy. Each template contains static sections:
- Environment Overview
- Segmentation
- Mitigating Controls
Using templates:
- Browse or search templates by vendor, platform, or model name
- Click a template to open the inline view panel with per-section content
- Use Copy to Clipboard buttons on each section to grab content for your Archer submission
- Templates are also accessible from the Ivanti Queue when processing Archer-type workflow items — use the Template Selector to pull relevant content directly into your workflow
Managing templates (Standard_User and Admin):
- Create new templates with the full section structure
- Clone existing templates as a starting point for variations
- Edit and update template content as environments change
User Settings
Access your profile settings from the user menu in the top-right corner.
Profile view:
- Your username, display name, group assignment, and team assignment(s)
- Your Ivanti identity (first/last name used for FP workflow filtering)
Password change:
- Click Change Password in the profile panel
- Enter your current password and the new password
- Passwords must meet minimum length requirements
Note: You cannot change your own group or team assignment. Contact your administrator for role or team changes.
Admin Features
Note: All features in this section require the Admin group.
User Management
The Admin page includes a User Management panel where you can:
- View all user accounts with their role, group, team assignment, and Ivanti identity
- Create new users with username, password, group, and team assignment
- Edit existing users — change their group, role, team assignments, or Ivanti identity
- Delete user accounts
- Reset passwords for other users
When creating a new user, assign them to the appropriate group and one or more teams. They will only see data for their assigned teams.
Audit Log
The Audit Log panel shows a chronological record of all state-changing operations performed in the dashboard. Each entry includes:
- Timestamp
- Username of the actor
- Action performed (create, update, delete, login, export, etc.)
- Entity type and ID affected
- Details of the change
Use the audit log for compliance investigations, change tracking, or security reviews.
View As — Impersonation
The View As feature lets you temporarily view the dashboard as another user to verify their permissions and data scope.
- In User Management, find the user you want to impersonate
- Click the eye icon next to their name
- The dashboard reloads showing exactly what that user sees — their pages, their data, their permissions
- An amber banner appears at the top of the screen indicating you are viewing as another user
- Click Exit on the banner to return to your own view
All access checks use the impersonated user's identity — you see their team data, their page access, their restrictions. However, the audit log still records your real admin identity for traceability.
Use View As to verify a new user's setup before sharing credentials, or to troubleshoot access issues reported by team members.
Scope Toggle
The Admin Scope Toggle allows administrators to temporarily restrict their own view to a single team's data, simulating the experience of a team-scoped user. This helps when reviewing team-specific findings or compliance data without the noise of cross-team visibility.
Tips and Best Practices
Triage workflow:
- Start on the Reporting page with the Group by Host toggle enabled to reduce noise
- Sort by severity (descending) to prioritize critical findings first
- Use the BU picker to focus on one team at a time
- For each finding, check the CARD tooltip to verify asset ownership
- Add findings to the queue by workflow type — FP for false positives, Archer for risk acceptance, Remediate for legitimate vulnerabilities needing action
- Process your queue in batches — submit FP workflows together, generate Granite sheets together
Compliance monitoring:
- Check the Compliance page at least weekly after your team's upload
- Focus on metrics where the health card shows degradation (red trend arrow)
- Use the Detail Panel notes to document remediation ownership and ETA per device
- Generate Granite Loader Sheets for any devices that need to be routed through the remediation workflow
Staying organized:
- Use the Recent Activity feed on the Home page to catch up on team actions
- Check your notification bell for sync completions, workflow status changes, and system alerts
- Mark notifications as read to keep your unread count meaningful
- Use the Knowledge Base for referencing team policies and triage playbooks before making decisions
Export habits:
- Export findings before and after a triage session to document your progress
- Export compliance data weekly for offline reporting or email distribution to stakeholders
- The Exports page generates point-in-time snapshots — export regularly if you need historical baselines
Jira integration:
- Create Jira tickets from the queue consolidation modal when multiple findings on the same host need a single remediation ticket
- Use JQL Lookup to check for existing tickets before creating duplicates
- Save relevant tickets to the dashboard for tracking without switching tools
Working with CARD:
- Always verify CARD ownership before routing a finding to a team for remediation
- If a CARD tooltip shows no confirmed owner, use the Detail Modal to search by Host ID for more complete data
- Confirm or redirect ownership through the dashboard to keep CARD records current
Granite Loader:
- Set bulk defaults first, then override individual cells — this saves the most time on large batches
- Use drag-fill for columns where adjacent rows share the same value (site codes, team names)
- Use the OS Type dropdown instead of typing — it prevents formatting mismatches that Granite rejects
- If you have an existing supplemental hygiene workbook, ingest it first to avoid duplicating work
- Select All + persistent selections lets you quickly build a full export across paginated results
Feedback and Bug Reports
If you encounter a bug or have an idea for a new feature, use the Bug Report or Feature Request buttons in the user menu (top-right, next to your profile). These submit directly to the development team and help prioritize improvements.
For questions about your access level, team assignment, or account setup, contact your dashboard administrator.