Dashboard Usage

This guide provides detailed instructions on the most important and commonly used features of our dashboard, complete with additional comments, scenarios, and practical examples.

Overview

Welcome to the White Cloud Security Dashboard. This manual is designed to help you navigate and operate the WCS Dashboard with ease. By following the instructions in this guide, you will become proficient in using the dashboard to manage your security tasks effectively. If you encounter any difficulties, feel free to revisit this manual as needed.

When you first access the dashboard, it might seem complex and overwhelming. This is a common initial reaction, but with practice and familiarity, you will find it intuitive and user-friendly. This guide will walk you through the essential features and functions, providing step-by-step instructions to ensure you can perform your duties confidently and efficiently.

Profile Settings

Let's begin by exploring our Profile Settings which you can see in your starting page. Click the "Gear" button.

Here in Profile Settings, you can change your photo, turn on two factor authentication to keep you account secure, reset your password for accessing your dashboard, get API Keys, change your personal information, your alert email address, the visibility you would like your profile to have and lastly the option to disable your account. Make sure to click "Apply Changes" in case you do make any changes.

Close the profile settings panel.

Main Menu

Out of all the buttons that you see in your Main Menu, the three places where you are going to spend the majority of your time are "Groups I Manage" "Groups with Alerts" and "Graph View of My Org".

Groups I Manage will show you all the groups you manage depending on your access level.

Groups with Alerts will show you all the alerts(Monitor Mode, Blocked Apps, and Host events) that you have in all of the groups you manage.

Here is an example of how it looks in the "Groups with Alerts" panel. In this case we have 40 Monitor Mode Exceptions in one of our groups called Test Lab and one Blocked App event in one of our groups called Sales that belong to the organization "my sandbox".

In this dropdown list, you can configure the time you want the alert panel to refresh itself in order to show you new event alerts. If you don't want to wait for the time to be over, you can click the name of the panel "Group with Alerts" or the "Refresh List" button at the bottom of the panel to reflect new events as they happen.

To make your life easier while working, we provide you with a variety of filtering options, so you can be very efficient in your day by day management. For example, if you are an admin for more than one group and you want to move around groups you can select at the "Filter Subgroups" section "By Admin Access" and your groups will appear on a dropdown list, by selecting each of your groups you will see their alerts.

If you want to be alerted by a sound when you have new alerts coming, click on "Enable Alert Sounds" and configure the volume and also the ping sound.

You also have a shortcut section with three buttons: Blocked Apps, Monitor Mode Exceptions and Run Apps History.

Those three buttons when clicked will give you information about your events in all the groups you manage, according to your access level.

Next, you will learn how to configure your dashboard settings. Click the Gear button on top of the alerts panel. If you want to hide the dashboard settings, click the Gear button again.

In this panel you can configure important settings such as your time zone, "Shortcut Mode" if you want to reduce the amount of buttons you have in "Your Profile" panel. Default Event Date range will change your event lists to one month before your current day. This way you can visualize everything that happened during that timeframe (You can choose your preferred date range). Banner Display can be configured to last more or less time according to your preferences. If you make any changes, click on "Save Changes."

This is how it looks if you decide to configure the use of dropdown lists in your dashboard settings.

Close your current "Groups with Alerts" panel and it is time to explore one of our newest features called the "Graph View".

There are two ways to access the graph view, the first way is through your Main Menu by clicking on "Graph View of My Org".

The second way to access your Graph View is through "Your Profile" section by clicking the button at the top or clicking "My Tree View".

Note: If for example you are located at the "Test Lab" subgroup and you click "My Tree View" you will have the tree view of Test Lab and its inheritance tree.

Graph View

This is the "Test Lab" subgroup and as we can see we are part of the group Internal which is part of "my sandbox Main Account" (The top of the tree). The tree view makes navigation throughout your groups quick and easy. Let's move to the "Internal" subgroup by clicking it directly.

We are moved to the "Internal" subgroup with just one click and we now see that the "Internal" subgroup has more subgroups below it in its inheritance tree.

Profile Menu

The Apps I Trust button provides you with information about the apps and CERTs in any subgroup you go to. Click on "Apps I Trust" to see more information.

In this case, the "Internal" group only has trusted two CERTs, and you can disable them or re-enable them. You are also provided with a filter to search by App Name or CERT by clicking "Filters".

Click "APPS I RAN" in order to see information about real time app usage running on your system or systems located in your group.

This is extremely useful, if for example, one of your admins trusts a CERT that they should not have trusted and you have to determine the kind of apps that were connected to this certificate, at what time this happened and when those apps ran in your system or systems and were signed with that specific certificate. This is all facilitated by the filters available to you.

Click "PROFILES I TRUST"

Profiles I Trust allows you to trust a profile of a product or person whose trust you would like to inherit. In this case we see that I trusted an "Admin Group". This means that I will inherit trust from this profile.

"Groups Trusting Me" is an admin group or groups that have trusted you to handle the trust of people who trusted them. If an admin group trusts me, then I will be part of an admin group and I will be able to access and manage everybody's subgroups who trusted the admin group.

Subgroup Menu

Here is another example of "Profiles I Trust". Click on Profiles I Trust on the Subgroup Menu, part of the Subgroup Configuration.

We at WCS, are constantly adding new trust to the profiles to make sure that all of our customers have the best protections. For example imagine a situation in which you are in Monitor Mode (Not protected, but alerted) and suddenly you execute a file that you thought it was legitimate, but, unfortunately, it was instead, a piece of "Ransomware" looking to encrypt your system. Surprisingly, however, the moment the ransomware tried to execute, it was blocked instantly.

What just happened? Why was the Ransomware blocked if I am not protected!? In this scenario, a few days ago, you trusted "Ziggy at White Cloud" and he had already added a Malware policy to his Trust-List identifying this same threat as Ransomware, and because you trusted him, his trust is inherited to you and to everyone who trusts him.

Software I can Trust is a very fast way to add trust by trusting product profiles of common software products that you are likely to encounter in your daily life or job. Click Software I can Trust to see more information.

Software I can Trust allows you to easily trust and manage the profiles of well-known, safe commercial software or software developed in house.

Now that Adobe has been trusted, I could run the Adobe tools without any issue.

If you suddenly decide that you are no longer required to use a product, you can just click "Distrust" to disable the trust in your subgroup.

"Admins I Can Trust".

Admins I Can Trust is all the admin groups you can trust, if you want them to manage your group or groups.

Click "Manage Advisor Access" if you are interested in inviting someone you know in order to help you with your subgroup's trust by making them an admin, or only granting them "Advisor" access for them to give you advice.

I can not manage my trusted apps alone, and I think I need to tell my friend John who is very smart. If I want to grant John permission to access to my subgroup I need to certify that I know him by clicking "I know Them".

Now, in the example below, John is an Advisor to my subgroup and he can see what apps I use in Monitor Mode and what apps get blocked in Blocking Mode. Thanks to his access, he can now help me take a decision in terms of what needs to be trusted and what needs to stay blocked.

I want to give Edit Access to John, so he can make changes for me, I click "Advisor".

John has been doing a great job and it is knowledgeable about app trust, I will make him an admin, so he can manage my subgroup and the subgroups that fall under it.

Today I received a call from John saying that he just found his dream job in another country and he is now planning to move, so he can not manage my groups anymore. I need to remove his access privileges as an admin by clicking on "Stop Admin".

Click "Stop" to remove his Edit Access too, this way he can not make changes.

John, is still my Advisor, in order from me to stop him from being my Advisor, the only thing I need to do is to click the interrogation mark "?" where John's account is located.

Click "Certified Advisors" to see your trusted advisors.

This section of "Advisors I know" reflects the advisors you trust right now. If you stop letting an Advisor have access to any of your Advisors in "Manage Advisor Access", it will stop coming up in this list.

"Directly Trusted Profiles" are the profiles you trusted and are giving your subgroup or groups trust from their inheritance tree.

In this example I have trusted six profiles and their trust is being inherited to me.

Click "Trusted & Inherited Profiles"

In this panel, you can see all of the profiles that were directly trusted from "Profiles I Can Trust" and the green arrow means that your trust will inherit to them.

Trust-Lists

Click "Show Trust-Lists" to access specific subgroup Trust-List.

This is your subgroup's Trust-List, the place where all of your Trusted Apps, Trusted CERTs, Trusted Folders and Block Policies(Malware,Denied,Distrusted) live and co-exist. Every time you trust an app based on its handprint, trust a CERT, apply a Block Policy, you will find it here.

Click "Add Fingerprints" if you want to import a Fingerprint File to add to your apps on your Trust-List.

Online Help

"Online Help" is the place to go if you have an issue or you need help related to our dashboard or our service.

You will be transported to the Online Help section where you can see our User Guide, and read technical documentation and if you can not fix your problem, email our support team or call us.

Newsfeed

Click "Show Newsfeed"

The News Feed is the place where you can see what you and the people you trust have been doing. For example, "Ziggy at White Cloud untrusted an App on Test Lab". The News Feed can also be used to add comments to the subgroup's admins or owners (according to your access level).

Click the "mail letter" button to open the comments panel, so you can add a comment to your news feed or to other group you have access to.

This is how it looks, you can enter a title for your post and then a comment, after you wrote your message, click "Post" to post it.

Click on the "Gear" icon in "YOUR NEWSFEED", to configure what you see on your news feed and the number of posts you wish to see.

Recently viewed

The "Log" button will help you hide your "Recently Viewed Subgroups". If you want to see this section again in your screen, click it again.

Alert Info Options

The "Alert Info Options" button gives you four different options to see more information about your organization, subgroups, everything you manage and your clients.

Click the red alert to hide that specific panel.

Click the "Alert Info Options" button if you want to hide it.

Admin Pages

Another useful place that at some point you will encounter, according to your level of privileges is "Open Admin Pages".

At the "Open Admin Pages" panel we have a lot of tools that will make a difference in more complex situations when you are looking for specific and specialized info about your organization, including moving computers in between subgroups.

Profile Menu - Shortcuts

Let's make a quick refresher on what the Profile Menu buttons do. The red lock is the Blocked Apps list, click it to see your blocked apps.

The yellow button with a magnifying glass is the Monitor Mode Exceptions list. Click on it to see your Monitor Mode alerts. Below you can see how it looks when you have blocked apps.

This is how it looks when you have Monitor Mode Exceptions, in this example we had a lot of alerts coming as "Monitored Children". For more information about the types of trust and methods to add trust, please check our other sections.

This is the "Run Apps History" where you can see all of the apps executing in your system or systems in real-time.

This is how it looks when you have a system running and all of your apps and system apps are being seen as they execute. We provide you with additional filters to help you make complex searches and gather all the info you need.

This is the "Trusted Apps" button in which you can see what apps have been trusted in that specific subgroup.

This example shows you have several apps trusted and indicates which one is an app, which one is a Trusted CERT, and more.

Next, let's click on the "Trusted Profiles" button to see your trusted profiles.

This is an example of your Trusted Profiles panel when you have added profiles that you trust and you want their trust inheritance to be inherited to your subgroup.

The "Host List" will show you how many computers you have on that specific subgroup.

This is how it looks like when you have computers in your "Host List". In this example we only have one computer.

Now, it is time to explore the "Groups" button (The WCS logo icon).

This is how it looks when you do not have any subgroups falling under or created within you subgroup. For example, I have 0 subgroups to show right now on Test Lab, however, if I click "Add new Subgroup" I will be able to see it in this list.

Click Edit Parent to go up one level in your group system or tree.

We are now at the "Internal" subgroup, one level up from Test Lab. Test Lab and IT DEPT are subgroups created inside the group "Internal" as explained in the previous step.

Let's make things more interesting and open the Tree View to compare the "Groups Panel" and the "Tree View".

Learning to navigate through your organization groups is a quick process, and will enable an administrator to identify and effectively manage and intercept malware and suspicious software, preempting their ability to disrupt or otherwise impair your operations.

We will now do a refresher on the Tree View and compare it to your groups panel.

We are on Internal's group, and you see that IT Dept has subgroups falling under it. I can move to any group I have (according to my access level) by just clicking the Tree View's buttons with their group's name and it will immediately be reflected in the profile panel. I see that I have 40 Monitor Mode events on Test Lab which is in "Monitor Mode" and I can jump quick and click Test Lab's group and click the Monitor Mode alerts button (yellow magnifiying glass) and apply filters, to see how many are signed or unsigned, launch a quick VirusTotal scan to see if there are any issues, and, if so, the source of the alerts. For help on Investigations, please see our section "Conducting Investigations".

Importance of Trust Inheritance and Best Practices

"Trust Inheritance" is one of the most important processes to the administrator. Successful management of Trust Inheritance begets successful management of Trust Lockdown, and helps ensure an impregnable computer network. This is essential for your success using our product, every subgroup has their own Trust-List and you might want to consider separating one department from another, basically, I will never allow unknown software at a group's Trust-List where my Domain Controllers are running, however, I could allow that unknown software on a different isolated subgroup that is not related and falls on a different tree branch.

The Marketing department uses one kind of software and the Finance department uses another kind of software and the IT Security department uses a completely different type of software.

My recommendation is to avoid adding trust at the tree's top level, unless it is strictly necessary. Remember that Trust will inherit from the top level to your groups down the inheritance tree. Be mindful of what software you add at your tree's top level, because software should be legitimate and verified, but also needed by all of your organization, then you can add the program at the top level of the tree. The risk your organization is taking by using this feature is high. Do not add unchecked, unknown and unverified software at the top level of your tree, because if this software is malicious it will be able to run everywhere, it is better to stay far away from one of those situations.