Patch and compliance dashboard
The dashboard shows every Windows and Linux node in one table: its pending updates, its baseline score and the fixes you can run. A node is a managed machine. Its agent is the Salt minion that runs on it.
To open it: in the console, choose Overview > Dashboard.
What the page shows
For admins on a new install, a Get set up card comes first: license, first machines, a teammate who can approve, alerts, vulnerabilities and a first patch run. Each step shows Done once Gardience sees it done; the card disappears when all are, or for everyone when an admin chooses Hide this. See Your first hour.
The top row has five numbers:
| Number | Meaning |
|---|---|
| Managed nodes | Every enrolled node in the last scan. |
| Patched and passing the baseline | Nodes with no pending updates and no failing baseline controls, out of the total. |
| Pending updates | The sum of pending updates across the fleet. |
| Patch success, last 30 days | The share of machine updates in patch runs (Patch a node group, Patch to the tested set, Fix a CVE) that succeeded over the last 30 days. Machines the readiness check left out are not counted as attempts. Hover for the numbers. |
| Audited actions | The number of entries in the audit log. |
The Fleet status table has one row per node:
- Node: the node name, with up to five of its pending updates listed underneath.
- Operating system: Windows or the Linux distribution, plus the Salt agent version.
- Updates: "Up to date" or the number pending. Windows nodes that need a restart also show "Reboot pending".
- Baseline (STIG/CIS): the score as a bar and a percentage, with the failing controls listed under controls.
- Fix: buttons for the fixes this node needs. See Patching Linux and Windows.
Nodes that need attention are listed first. The table shows 200 nodes per page. To find a node, type part of its name or operating system in Find a node or OS and choose Search.
Fix the machines you choose
Fix all fixes every non-compliant node. To fix only some:
- Tick the box at the start of each row you want. To tick a run of rows, tick the first, hold Shift, and tick the last. The box in the header ticks every row on the page. Or use a quick pick above the table: this page, needing updates, needing the baseline, or needing a restart.
- Choose Install updates, Apply baseline, or Restart in the bar that appears, and confirm.
The fix runs as you, under your role, with the same checks as the per-row buttons: locked nodes and nodes your role may not change are left out and named. Applying the baseline to, or restarting, more than one machine waits for a second person to approve it, unless you are an admin and Settings > Approvals lets admins act alone. It is listed under Automation > Workflows and approvals as "Fix selected". The same machines asked again while that request waits are the same request, not a second one.
On a narrow window the table scrolls sideways inside its card, and the menu button at the top left opens the menu over the page.
Two more cards sit below the table:
- Drift auto-repair: the latest services that stopped and were restarted by an event rule. See Drift checks and event rules.
- Audit log: the latest changes made by people. Read-only calls and scans are left out of this view but stay in the full log. See Reports, evidence and audit.
Compliant, scored, unscored and stale
A node is compliant when both of these are true:
- It has no pending updates.
- Its baseline was scored and no control failed.
A pending restart does not affect compliance.
Scored means the node's baseline check came back and at least one control could be evaluated. The score is the share of evaluated controls that pass. Controls that do not apply to the node (for example, SSH checks on a Linux node without an SSH server) are marked "na" and left out of the score.
Unscored means Gardience has no usable baseline result for the node. An unscored node is never counted as passing, so it is never compliant. The Baseline column shows one of two labels:
- not scanned: no baseline result has arrived for this node yet.
- not scored yet: a result arrived, but no control on the node could be evaluated.
Stale means the node did not answer the last scan. It is busy, asleep or offline. Gardience keeps its previous result and adds this note under the node name: "no answer on last scan (busy or offline); showing previous result." The node stays in the table until its key is removed from the fleet.
If a node's update search fails, the error appears in its pending list as "scan-error" and the node counts as not patched.
Scans and their timing
A scan asks every enrolled node for its operating system details, its pending updates, its baseline result and, on Windows, whether it needs a restart.
- Gardience scans the whole fleet when the service starts, then again 5 minutes after each scan finishes.
- To scan now, choose Rescan. The page reloads when the scan is done. If a scan is already running, Gardience waits for that one instead of starting another.
- Each step waits a limited time for answers: 30 seconds for node details and the baseline check, and 45 seconds for update searches. Nodes that answer later are filled in by a background task as their answers arrive (up to 30 minutes for update searches and 15 minutes for the baseline). A node that is still searching for updates keeps its previous update list until the search finishes.
- Gardience asks package repositories and Windows Update for fresh data at most every 6 hours. Scans in between use each node's cached update data, so a newly published update can take up to 6 hours to appear.
- Gardience sends its own Salt modules to a node when the node first connects, and again every 6 to 12 hours. If a node was rebuilt and lost them, the next scan sends them again and scores it in the same scan.
- After a fix, Gardience rescans the affected nodes about 10 seconds after the job ends. After a reboot it waits about 2.5 minutes first, so the node has time to come back.
The time of the last scan (UTC) is shown under the page title.
Export the status
To download the table as a CSV file: choose Export CSV on the Fleet status card. The file has these columns: minion, os, pending_updates, baseline_score, baseline_failing, compliant, pending.