Workload Protection Coverage provides a real-time view of security coverage across your hosts, ECS Fargate, and EKS Fargate workloads. Use Coverage to assess protection posture, identify gaps, and act on unprotected or misconfigured workloads.
Coverage reflects whether the policies and Agent rules on each resource loaded successfully. For how policies reach your Agents, see Enable and deploy policies.
To identify and address coverage gaps, see Review and Improve Coverage.
Views
Coverage has two views. Use the toggle at the top of the page to switch between them:
Explorer: A faceted table of your resources. Search and filter resources by Agent, Rule, Policy, Infrastructure, and Container facets, then open a resource to inspect its Agent rules and policy deployment status.
Map: A visual map where each resource appears as a hexagon colored by its coverage status severity.
In both views, you can:
- Group by Cloud Provider, OS, Agent Version, Severity, or Kubernetes Cluster.
- Refresh the view on demand.
A resource appears in Coverage as soon as its Agent loads its ruleset. When a resource goes offline, it is removed from Coverage within 15 minutes.
Coverage statuses
Resource coverage status
Each resource’s coverage status falls into one of two severity categories, based on the rules loaded on it:
| Severity | Meaning |
|---|
| Pass | All rules loaded successfully or were filtered as expected. |
| Error | One or more rules have errors that need to be fixed, or the resource reported incomplete data. |
In the Map view, resources are displayed as hexagons colored by severity. Click a hexagon to inspect a resource and view its policies and rules.
Policy statuses
Each policy loaded on a resource has one of the following statuses:
- Loaded: All of the policy’s rules pass.
- Error: One or more of the policy’s rules are in error.
Rule statuses
Each rule reports one of the following statuses:
- Loaded: The rule loaded successfully.
- Filtered: The rule was intentionally not applied (for example, the Agent version is too low or the event type is disabled).
- Error: The rule failed to load.
When a rule is filtered or in error, a verdict explains why:
| Verdict | Meaning |
|---|
syntax_error | The rule expression is invalid. |
unknown | The Agent could not load the rule. |
filtered_agent_version | The Agent version is too low for this rule. |
filtered_event_type_disabled | The event type is disabled in the configuration. |
filtered_rule_filter | The rule was excluded by a rule filter. |
To understand why a rule is failing, select the resource to open its side panel. The side panel lists the resource’s policies and rules. For each rule, it shows the expression, the status and verdict, and the error message reported by the Agent.
Further reading
Additional helpful documentation, links, and articles:
