Frameworks covered
Which frameworks appear depends on your environment. The panel only shows what applies to the targets you actually have connected — a tenant with cloud accounts sees cloud benchmarks that a tenant with only network gear never will. Two kinds of framework show up side by side:Standards and regulations
CIS Benchmarks, NIST CSF, ISO/IEC 27001, PCI DSS, SOC 2,
HIPAA, LGPD, Bacen and MITRE ATT&CK — the external
references an auditor will ask about.
Per-platform baselines
A hardening baseline for each platform you’ve connected — Windows, Linux,
macOS, and connected tools such as Bitdefender, Wazuh, Elastic Security,
Mikrotik and GLPI.
cis-aws, cis-m365 or cis-gcp, each mapping to that provider’s benchmark.
These frameworks form the Conformity by framework panel on the Security Posture dashboard, where each one gets its own gauge showing the score and how many controls pass out of the total.
How findings map to frameworks
Each finding is tagged with every framework control it touches, and the control identifier travels with it —cis-aws-2.1.5, MRX-MKT-SVC-003. That mapping does two things:
- The conformity panel rolls findings up per framework, so you can see where you’re strong and where you’re exposed against, say, PCI DSS versus CIS.
- The controls table lists every control evaluated, with how many resources are failing it and across how many targets, so you can work the list down.
The controls table filters by status, severity and category — not
by framework. To pull everything affecting one standard, read it off that
framework’s gauge and work from the failing controls.
How scanning works
Scanning is per target and module-based. A target is any device or integration you’ve connected — a host with the Myrmex agent, a firewall, a SIEM, an EDR console, an ITSM. Each one carries its own switches, and the two that feed Security Posture are:
That’s why the dashboard carries two sub-scores rather than one: they come from two different modules, and a target can have one enabled and the other off.
A third module, Topology, sits alongside them but feeds the organization
map rather than your posture — it collects the target’s interfaces, neighbour
table and routes.
Enabling auditing on a target
Auditing is turned on per target, from that target’s own detail view. Where you find it depends on what the target is:1
Open the target
Open a device or integration from the Directory.
2
Go to its configuration tab
On a host the tab is Configuration; on an integration it’s
Settings.
3
Turn on the module
Under MODULES, switch on Audit — and, on a host, Vulnerability
as well if you want CVE coverage.
When a target stops reporting
The Environment breakdown table carries a Last scan column, and on a healthy fleet those timestamps stay within the last 24 hours. A target stuck days or weeks in the past isn’t a scoring problem — it’s a target that stopped reporting, and its score is frozen at whatever it last sent. The most common reason is that the target is no longer in the fleet at all: a device that was decommissioned, uninstalled or de-enrolled keeps its last reported state cached in the view. Beyond that, the checks worth running in order are:Posture scanning is proactive analysis on a fixed cycle. For active threats,
alerts, and investigations, see Detection & Response;
for an assessment you run yourself, right now, ask for it in chat — see
AI-driven audits.
Where to go next
Security Posture
The scored dashboard, the panels, and the controls table.
Remediation & risk acceptance
Act on the findings a scan produces.