What is a Monitor?
Monitors are the engine behind continuous compliance within Thoropass. At their core, a monitor is just a query to a connected system — like AWS, Okta, Jira, or Datadog.
Each monitor provides an answer to a common compliance question like:
"Are all production S3 buckets encrypted?"
"Are all Postgres databases backed up?"
Depending on what the query returns, the monitor may report a result such as:
Healthy
Needs Attention
No Data Detected
Connection Error
To learn more about monitor results, please click here.
What is the purpose of a Monitor?
Monitors generally serve one of two purposes:
1. Enforce Compliance Rules
Some monitors check that you're following recommended practices for secure, auditable operations. Think of them as proactive alerts to help you fix misconfigurations early and often — before they snowball into audit pain.
Example:
A monitor flags an admin user in AWS that is without MFA. This violation is not necessarily going to lead to an audit finding, but it’s a finding that is worth investigating.
2. Collect Audit-Ready Evidence
Other monitors collect structured evidence — such as a list of GuardDuty settings, software changes, or background checks — that can be used instead of manual screenshots when it's time to complete your audit.
A note on interpreting Monitor results
A failing monitor does not necessarily indicate non-compliance or that your audit is at risk. Monitors operate without business context, meaning they evaluate technical configurations but cannot assess intent, scope, or compensating controls.
To help you manage and triage results effectively, Thoropass provides a few built-in workflows:
Exclude / Auto-Exclude: Suppress monitor violations that are not relevant to your environment (e.g., non-production resources or intentionally configured exceptions).
One-Click Fix: Resolve common failures quickly using guided remediation workflows with step-by-step instructions.
Monitors are designed to surface potential issues early, support continuous improvement, and streamline evidence collection—not to serve as absolute indicators of audit readiness. Use them as a tool for operational visibility and audit efficiency.