INNOVEXUS / docs innovexus.io →

SOC workspace

Security operations: what is exploitable, what is on the endpoints, who is on the devices — and the intelligence feeds that keep those answers current. Set it up in this order and each step feeds the next.

SOC Command Center with compliance, KEV, fleet posture tiles, a Needs-a-human queue and feed status
The SOC Dashboard — posture tiles, the “Needs a human” alert queue, and live status of every intelligence feed this appliance receives.

1 · Verify the intelligence feeds

The appliance receives its intelligence from the innovexus.io hub by outbound HTTPS (“call-home”) — nothing inbound to open. On the SOC Dashboard’s Feeds & collectors card, each source should read synced / loaded:

FeedWhat it drives
NVD CVE catalogThe CVE database and CVSS scoring behind the vulnerability pages.
CISA KEVThe known-exploited queue — the “act first” list.
IOC threat IPsMatched against collected flow telemetry.
Hub call-homeRelease and agent update notices, feed delivery.

If a feed is stale, Pull IOCs now forces a fetch; delivery details and keys live in Settings → General → Feeds & keys. A fleet that cannot reach the internet can still receive feeds through the hub mirror — see the proxy settings under Settings → Updates.

2 · Work the vulnerability queue

Vulnerability dashboard: KEV count, severity distribution, affected devices ranked by exposure
Vulnerabilities → Dashboard — KEV matches first, severity across all matched CVEs, and the devices ranked by exposure.

The workflow, left to right:

  1. Review KEV queue — CVEs on your inventory that are being exploited in the wild. This list is short on purpose; clear it first.
  2. Affected Devices — exposure per device; one box usually carries most of the findings, and patching it clears them all at once.
  3. CVE Database / CISA KEV — the full searchable catalogs when you need to chase a specific advisory.

Matching runs automatically against the device and endpoint inventory after every feed sync — there is nothing to schedule.

3 · Endpoint security: install the Bridge Agent

Endpoint Security dashboard with endpoints, baseline conformance and findings
Endpoint Security → Dashboard — agent-reported endpoints, baseline conformance and open findings.
  1. Download the installer for Windows or Linux from the appliance (the install link is minted per organization — Endpoint Security → Endpoints → Add).
  2. Install it on the endpoint; the agent enrolls over HTTPS to the appliance, appears under Endpoints, and keeps itself registered. How agents are updated fleet-wide is its own page: Bridge Agent updates.
  3. Define Baselines — per-OS bubbles of expected posture (services, firewall, patch level…); each endpoint reports conformance to its bubble.
  4. Run or schedule Scans; triage what they raise under Findings.
Findings can enforce. On networks using the built-in NAC, a finding can quarantine the endpoint at the switch port (a CoA moves it to the quarantine profile) — the override lives on the finding itself.

4 · Compliance

Compliance → Policies holds the rule sets; Scans runs them against devices and endpoints on demand or on schedule; failures open Tasks with the evidence attached. The posture tile on the SOC dashboard is this system’s summary.

5 · Session oversight

Live sessions page listing who is connected to which device
Sessions → Live Sessions — every person on every managed device right now, one row per session.

Every terminal session brokered by the appliance is visible here live, with full history and logs. A SOC operator can:

6 · Collectors: syslog & flows

Two collectors turn raw network exhaust into searchable evidence. Both are fed by one-line device changes (details and more snippets in the NOC guide):

! Cisco IOS — send syslog to the appliance (UDP 514)
logging host <appliance-ip>

7 · Lifecycle & the paperwork