Appearance

What Are Audits? ​

Audits are scheduled, read-only checks that watch your clients' environments and surface the exceptions that need attention. On a schedule you set, an audit scans the companies in its scope, produces a finding for anything that fails its check, and hands that finding off to a response — so only the exceptions ever reach you.

Audits detect; runbooks act. An audit never changes anything — it only reads state and emits findings. When a finding opens, you decide what happens next: report it, open a ticket, or run a runbook to fix it.

Access

Audits are available when the feature is enabled for your organization. Anyone on your team can view audits and findings, but activating an audit, running a pass, and re-scanning are admin-only actions.

How Audits Work ​

  1. Scan — On its schedule, the audit runs a single pass across every company in scope, reading the current state from your connected tools.
  2. Findings — Each entity (a device or a user) that fails the check becomes one finding. Entities that pass are counted as compliant.
  3. Response — What happens when a finding opens is configured per company: do nothing, open a ticket, or run a runbook. Nothing fires until you set a response.
  4. Track — Findings move through a lifecycle (New → In progress → Needs attention → Resolved), and everything is kept on record.

The Audits Overview ​

The Audits list opens with a summary strip of four tiles:

  • Needs attention -- Findings that have persisted and require a human to act. This is the only red tile.
  • In progress -- Open findings that runbooks are currently working.
  • Resolved this week -- Findings closed recently, including those closed automatically by runbooks.
  • Acknowledged risks -- Findings a client chose to accept; links to the risk ledger.

Each audit in the list shows its schedule, scope (a single company or Global — all companies in scope), and current findings.

Read-Only by Design ​

An audit only ever reads. It can't change a device, a user, or a ticket on its own. Any change happens through the response you configure — and even then, only through a runbook or ticket you've chosen. This separation keeps detection safe to run broadly and puts every action under your control.

Audits vs. the "Audit & Compliance" Runbook Category ​

These are two different things:

  • Audits (this feature) are scheduled read-only checks under the top-level Audits area.
  • Audit & Compliance is one of the categories in the Runbook template gallery — a way to group action-oriented runbooks. A runbook in that category is a workflow that does something; an audit is a scheduled check that may trigger such a runbook through its response.

Next Steps ​