Working with the KSPM dashboard
To work with the dashboard, you need the security-deck.viewer role or higher for the folder containing the KSPM resources.
- Go to Yandex Security Deck.
- In the left-hand panel, select KSPM.
- At the top of the window, select the workspace.
- On the Clusters tab, make sure all the clusters are connected to KSPM and are in the active control status.
- Review the Dashboard tab. It has the following sections:
-
Top rules with alerts: Contains the most frequently violated rules within the control scope and gives the number of violations.
-
Section with overall statistics for the scope of control: Contains the number of clusters with KSPM connection errors, the number of clusters with security warnings, as well as Top clusters with alerts, and the number of violations.
-
List of alerts with threat type, status, and last update time info.
For each security rule violation, an alert is created with a detailed description of the violation, severity, detection time, list of affected resources and troubleshooting recommendations.
You can manage troubleshooting for each specific alert:
- Assign persons responsible for troubleshooting.
- Manage the alert status.
- Leave comments.
- Keep track of troubleshooting progress.
- Request analysis from the AI assistant.
-