FAQ on SecOps configuration

FAQ on SecOps configuration


Why my cloud account doesn't have governance configuration section?
Governance configuration section will be  available only for "Assessment + Governance" type accounts


Why my cloud account's alert configuration is in pending state for long?
Alert configuration is dependent on resource discovery

  • Go to Account governance dashboard.
  • Select the cloud account -> Check the rediscovery status 
  • If it is either in pending or in-progress, security configuration will be initiated within 10 minutes once discovery is completed


How much time does it take to complete security configuration?
Configuration will be initiated once discovery is completed. It might take 20 to 30 minutes. However, the time taken to configure might vary based on the number of regions selected in case of AWS whereas the configuration is on Subscription in case of Azure.


Will I get vulnerabilities for newly created VMs in Azure?
(i) If you configure Azure vulnerabilities from CoreStack, you will get the vulnerabilities for newly created VMs. - Access Type(Assessment+Governance)

(ii)If you make use of existing configuration, ensure that the auto provisioning is enabled in Azure Security Center settings to get the vulnerabilities for newly created VMs.


Why vulnerabilities  are not showing in CoreStack for Azure?
(i) Check the status of Log Analytics Agent under any of the following recommendations:

  • Endpoint Protection
  • Apply System Updates

(ii) Ensure the auto provisioning is enabled in AzureSecurityCenter settings with Workspace enabled and mapped to it.

(iii) Ensure you got the vulnerabilities in Azure by referring the below location


 Home-->Log Analytics Workspace---><Workspace name configured in Security Center> -->Azure Activity Logs--> Select GoToLogs on Subscription ---> Tables--->Security Center Free
Under Security Center Free, check if there are vulnerabilities for the following category which is supported in CoreStack

  1. ProtectionStatus
  2. Update
  3. Security Baseline 


why Inspector findings are not showing in CoreStack Security dashboard for AWS vulenrabilities?
(i)CoreStack doesn't support configuring Inspector for the AWS account.So pls ensure that the Inspector is already enabled in AWS for the selected regions with Assessment Template and Assessment Targets.

(ii)Ensure there are findiings available in AWS


why Azure threats are not showing in CoreStack?
(i) Ensure the security alert is configured in Azure;Action group should be configured with respective service account id in the webhook

(iii) Ensure the S3/Queue configurations are proper as part of pre-requisitie which is used by alert_queue_poller to poll the threats.


why AWS GuardDuty findings are not showing in CoreStack?
(i) Ensure the GuardDuty is properly enabled with bucket and kms configuration as per standard.

(ii) Ensure the bucket access

(iii)Ensure there are findings available in the configured bucket.

(iv)Ensure the S3/Queue configurations are proper as part of pre-requisitie which is used by alert_queue_poller to poll the threats.


    • Related Articles

    • FAQ on Custom Role Creation

      How are Permissions Determined for Custom Roles? Permissions for custom roles are determined based on the role type you select. These permissions are highly flexible and can be tailored to suit your specific use cases. Here's a breakdown: For ...
    • Required Permissions for GCP SQL and BigQuery Resource Tagging Governance

      Required Permissions for GCP SQL and BigQuery Resource Tagging Governance SQL Resources: To enable tagging for SQL resources in Google Cloud Platform (GCP), such as Cloud SQL instances, the following permissions and configurations are required: Cloud ...
    • AWS EC2 Cost Report not showing data.

      Scenario: When accessing the AWS EC2 Cost report, users may encounter situations where the report appears empty, despite the presence of EC2 instances in the Cloud. In some cases, users may encounter issues with AWS EC2 cost reports, specifically ...