Overview
Monitors help you stay ahead of compliance issues by surfacing potential violations in your systems. But not all flagged results are actual risks — some may reflect intended configurations or out-of-scope resources.
This guide walks you through how to evaluate a monitor, remediate legitimate issues, and exclude false positives when necessary.
Step 1: Open the Monitor Details Page
From the monitors page, select the offending monitor. Ideally, this monitor will have a status of
Flagged
Connection Error
The monitor detail page will display:
The specific resources returned by the monitor query
The reason it failed
The source system and last run timestamp
The full list of returned items (e.g., buckets, users, VMs)
Step 2: Evaluate the Monitor Logic
In the Overview tab, review the logic and description of the monitor. Most monitors are based on a clear, testable condition, such as:
All secrets automatically rotate
Ask yourself:
Are the flagged secrets meant to rotate manually for a valid business reason?
Are they in non-production environments or test accounts?
Is the monitor targeting the correct source system or scope?
Understanding the logic ensures you can differentiate between legitimate findings and results that don’t require action. You should also use this context to decide whether the result should be excluded.
Step 3a: Remediate a Legitimate Finding
If the monitor uncovers a genuine issue:
Scroll to the Fixing This Service section.
Follow the step-by-step remediation instructions (e.g., modify a cloud setting, enable MFA, rotate a secret).
After remediation, return to the monitor and Refresh it to verify resolution.
Once the result disappears, the monitor will update to Healthy on the next run.
Tip: Many monitors auto-create tasks for the relevant control owner to ensure issues are tracked to resolution.
Step 3b: Exclude a False Positive or Out-of-Scope Result
If the monitor result is not relevant or is intentionally configured:
Use the Exclude button next to the specific result.
Choose from:
Manual Exclude: For known and approved exceptions.
Auto Exclude: For recurring results that should always be suppressed (e.g., test environments, ephemeral containers).
Excluded items are:
Removed from monitor evaluations
Logged for audit visibility
Still viewable by switching the result filter (e.g., “All” or “Excluded”)
Note: If the entire monitor is out of scope (e.g., a GCP monitor when you only use AWS), consider disabling the monitor altogether instead of excluding individual results.
Step 4: Understanding the Outcome
Action Taken | Monitor Status After Refresh |
Issue resolved | Monitor becomes Healthy |
Result excluded | Monitor becomes Healthy (if all violations are excluded) |
No action taken | Monitor remains Flagged |