Skip to main content

Security Posture

Navigation: Sidebar → Security

The Security Posture page is your unified security operations center. It brings together threats from SentinelOne, email security from Checkpoint Harmony, vulnerabilities from Microsoft Defender, MFA status from M365, domain health, Sophos account health, and patch compliance — all with a single composite security score.

Security Posture Page

Security Score​

At the top of the page, a Security Score gives you an at-a-glance rating (0–100) of your overall security posture. The score is calculated from weighted components:

ComponentWeightSource
Endpoint Threats40%SentinelOne threat count and severity
M365 Security Score25%Microsoft Secure Score
MFA Adoption20%Percentage of M365 users with MFA
Domain Health15%Verified vs. unverified domains

Only components with data are included. If you don't have M365 connected, the remaining components are reweighted proportionally.

The score color indicates status:

  • 🟢 80+ — Good
  • 🟡 60–79 — Needs attention
  • 🔴 Below 60 — Critical

Quick Stats Cards​

Five stat cards provide instant metrics:

CardShowsSource
Active ThreatsUnresolved endpoint threatsSentinelOne
Email ThreatsUnacknowledged email security alertsCheckpoint Harmony
CVEs FoundDetected vulnerabilitiesMicrosoft Defender TVM
MFA AdoptionPercentage of users with MFAMicrosoft 365
Domain IssuesUnverified email domainsMicrosoft 365

Click any card to jump to its corresponding tab.

Tabs​

Overview Tab​

Score Breakdown — Shows each component's individual score and weight, with progress bars.

Recent Critical Events — Combined feed showing the most severe threats and vulnerabilities. This is your "what needs immediate attention" view.

Sophos Account Health — If Sophos is connected, shows the average account health score across tenants.

Threats Tab​

Displays endpoint threats from SentinelOne.

Severity Filter Cards — Click to filter by severity:

  • Critical (red) — Requires immediate action
  • High (orange) — Investigate promptly
  • Medium (yellow) — Monitor and plan response
  • Low (green) — Informational

Threat List — Each threat shows:

  • Threat name and classification
  • Affected device and client
  • Severity badge
  • Status (active, resolved, mitigated)
  • Actions: mitigate, rollback, quarantine, disconnect from network

Threat Details Dialog — Click any threat to see full details including file path, hash, detection engine, and timeline.

Sync from SentinelOne — Click the sync button to pull latest threat data.

Email Security Tab​

Displays email threats from Checkpoint Harmony Email & Collaboration.

  • Alert list with severity badges
  • Acknowledged/new status
  • Alert details and descriptions

Prerequisite: Requires Checkpoint integration to be configured.

Vulnerabilities Tab​

Displays CVEs detected by Microsoft Defender Threat & Vulnerability Management.

  • CVE ID and CVSS score
  • Affected software and vendor
  • Device count affected
  • Patch availability indicator
  • Severity filtering

NinjaOne Vulnerability Scan Groups — If NinjaOne is connected:

  1. Select a scan group from the dropdown
  2. Upload a vulnerability CSV export
  3. Data is parsed and stored for tracking

M365 Alerts Tab​

Security alerts from Microsoft 365 Defender:

  • Alert title and category
  • Severity and status
  • Detection timestamp

MFA Status Tab​

Multi-factor authentication status for all M365 users:

  • Each user shows MFA enabled/disabled/unknown status
  • Admin indicator badge
  • Color-coded icons (green = enabled, red = disabled)

Tip: This is one of the most important security compliance views. Clients with low MFA adoption are at significant risk.

Domain Health Tab​

Email domain verification status from M365:

  • Domain name and verification status
  • Primary domain indicator
  • Verified (green check) vs. unverified (warning)

Unverified domains contribute negatively to the security score.

Patch Compliance Tab​

OS patches pending installation across all devices:

Summary Stats:

  • Critical patches pending
  • Important patches pending
  • Total pending patches
  • Devices needing patches

Patch List:

  • Patch name and KB number
  • Device link (click to go to Device Detail)
  • Severity badge (critical, important, moderate, low)
  • Category (security update, feature update, etc.)

Tips & Best Practices​

  • Review the Security Score daily — It's the fastest way to assess your overall security posture
  • Prioritize critical threats — Use the severity filter to focus on what matters most
  • Track MFA adoption — Push for 100% MFA enrollment across all client users
  • Address unverified domains — These can indicate misconfigured email infrastructure
  • Monitor patch compliance — Critical patches should be deployed within 48 hours