Operations, Reporting, and Compliance
This domain tests day-to-day platform health, metrics, evidence retention, and compliance reporting. Expect questions on coverage reconciliation, content currency, audit trails, service-level metrics, and what a credible report must contain.
Core rules and concepts
- Routine operations include agent coverage checks, content and engine version monitoring, policy compliance, license capacity, management server health, repository synchronization, and backup verification.
- Coverage should be reconciled against an authoritative asset inventory. Missing agents may be stale, unmanaged, offline, excluded, or on unsupported platforms; each category needs a different remediation path.
- Track operational metrics such as mean time to detect, mean time to respond, alert closure rate, false-positive rate, and open incident age. Metrics must drive decisions, not just fill dashboards.
- Maintain audit trails for policy changes, exclusions, user logins, and administrative actions. Retain logs and evidence according to legal, regulatory, and contractual requirements.
- Map controls and evidence to applicable frameworks such as NIST, ISO 27001, PCI DSS, or HIPAA. Compliance reporting should state scope, exceptions, and residual risk, not just a pass percentage.
- Change management covers agent upgrades, policy changes, exclusions, and content repository changes. Back up the management server and test restore procedures.
Worked example
A monthly report shows 97% agent coverage. Reasoning: 97% is not automatically acceptable; the missing 3% may include critical servers. Reconcile the agent list with the CMDB and vulnerability scanner inventory. Classify missing hosts as decommissioned, offline, unmanaged, excluded, or failed deployment. If several database servers were excluded during a migration and never reinstated, document the exception, deploy agents in a pilot, and report the residual risk with a remediation date. Report both the percentage and the named exceptions; do not round up or claim full coverage without reconciliation.
Traps that cost marks
- Reporting alert counts instead of outcomes, trends, and risk.
- Ignoring stale or missing agents because the dashboard shows a high percentage.
- Retaining logs for less than the required period or failing to protect audit records.
- Making policy changes without change records or rollback plans.