Administration, reporting and operational best practices
Roles, delegation, and auditability
Administration starts with least privilege. Understand the admin role hierarchy - super admin versus scoped administrative roles versus read-only/auditor roles - and that role scope determines which policies can be viewed and changed. Federate administrator authentication with SAML and provision accounts automatically where possible. Administrative actions are recorded in audit logs, which is the first place to look when a rule appears to have changed by itself.
Getting data out
Operational reporting comes from dashboards and interactive reports, alerts, and log streaming. Nanolog Streaming Service (NSS) feeds raw web, firewall, DLP, and related logs to a SIEM. APIs provide configuration and log access for automation and custom reporting. Know the difference between a real-time stream, a scheduled report subscription, and an on-demand query in the portal.
Operating safely
- Change control - test rules with the policy-test capability before publishing, and stage rollouts by group or location.
- Hygiene - prune stale rules, review exception and Do Not Inspect lists, and keep rule names descriptive so audits are readable.
- Monitoring - watch authentication failures, connector health, and experience scores as leading indicators.
- Documentation - record why a rule exists; an undocumented exception outlives its reason.
Traps
- Assuming a read-only admin can make changes, or that API access ignores role scope.
- Expecting logs to be searchable in the portal indefinitely - streaming to a SIEM is the durable option.
- Publishing a global rule without a pilot group.
Worked example
A contractor needs visibility into web logs but no configuration rights: assign a scoped read-only role, confirm the admin scope limits them to the relevant locations, then verify in the audit log that the session performs no writes.