SecurityInsight settings

How many times Risk Analysis tries an AI request when the AI service times out, throttles or has a temporary failure.

Adds an AI-written executive summary of the Risk Analysis findings to the report email.

Caps the estimated Azure OpenAI spend (in US dollars) of AI classification in one profiling run.

The NAME of the Key Vault secret that holds the key of your Azure OpenAI resource -- never the key itself. Get Started > AI integration stores the key in your Key Vault and fills this in.

The Azure OpenAI API version used when calling your model deployment.

Name of the Azure OpenAI model deployment used for AI classification and AI summaries.

The web address of your Azure OpenAI resource, used for AI classification, AI tiering of roles and AI report summaries.

The largest answer, in tokens, the AI may return for each risk-analysis summary request.

The estimated price in US dollars of one AI call, used to keep each run within its AI spending budget.

A master switch that turns off AI asset classification for every collection engine, whatever else is switched on.

Switches off AI classification for the endpoint engine only, even when AI is on for all engines.

ONE switch for AI: on = AI for every engine that has an AI step (the endpoint and Azure engines classify the assets their rules cannot place). It needs the Azure OpenAI endpoint, deployment and key.

An override for ONE engine: turns on Azure OpenAI classification and application grouping for the Azure engine only, while AI integration is off. With AI integration on it changes nothing.

An override for ONE engine: turns on Azure OpenAI classification for the endpoint engine only, while AI integration is off. With AI integration on it changes nothing.

Per-engine AI switch for the identity engine.

How long the privilege tier classifier keeps its catalog while nothing it is made from changed. Every run reads the Entra role definitions, the API permission catalog and the Azure role definitions (seconds); when the...

An override for ONE engine: whether the privilege tier classifier asks Azure OpenAI to tier new roles and permissions. It follows its own switch, not AI integration: it calls AI whenever the Azure OpenAI settings are...

Decides whether the risk-analysis container jobs ask Azure OpenAI to write a summary of the findings.

Maximum estimated AI spend, in US dollars, for drafting rules from new findings in one schema-discovery run.

A version label for the stored AI signal weights per engine and asset type; changing it makes the engines ask the AI again.

Replaces the built-in instructions sent to Azure OpenAI when it classifies Azure resources.

Replaces the built-in instructions sent to Azure OpenAI when it classifies devices.

Reserved for replacing the AI instructions for identity classification.

Saves how many parts each large risk analysis query had to be split into, so later runs start at the right number.

After a run decided a report's split count, how many days pass before a suspiciously high count is tested again.

A report's split count this many times the median of the other reports' counts is treated as suspicious and tested again.

How many reports must have a split count before one count is compared with the others at all.

Splits large risk analysis queries into smaller parts automatically so results stay under Defender's row limit.

The most parts automatic query splitting may divide a risk analysis query into.

Runs risk analysis in Detailed mode: one row per affected asset, with the Detailed template, table and mail recipients.

Where Risk Analysis copies its Excel (and JSON) report after a run: an Azure Blob container URL or a Windows file share path.

How many attempts risk analysis makes for a Defender advanced hunting query before giving up.

How old the Microsoft Graph sign-in may get before risk analysis signs in again before a query.

Deletes the previous risk analysis Excel workbook at the start of a run and writes a fresh one.

Names the report template risk analysis runs: RiskAnalysis_Summary (compact) or RiskAnalysis_Detailed (one row per finding).

Deletes the saved query split counts at the start of a run so they are probed again.

Makes risk analysis run in Detailed mode unless Summary is asked for on the command line.

The report template used for Detailed runs when no template is named explicitly.

The report template used for Summary runs when no template is named explicitly.

Makes risk analysis run in Summary mode unless Detailed is asked for on the command line.

Optional. After each Risk Analysis run, copies its report rows into your Log Analytics workspace (SI_RiskAnalysis_Detailed_CL, and SI_RiskAnalysis_Summary_CL when the Summary report runs; the day's trend row in SI_Tre...

How many slices a Detailed Risk Analysis query is split into on the first try, before automatic splitting adapts.

How many smaller pieces a timed-out Risk Analysis query slice is split into each time.

How many extra attempts a query slice gets at the end of a Risk Analysis report when it failed earlier because the service was throttling or unavailable.

How many times a Risk Analysis query slice that the service answers as too large is sent at the same size before it is split into smaller slices. 1 splits it on the first too-large answer.

How many times a Risk Analysis query slice is retried, after signing in again, when it fails with a temporary error such as an expired token or a gateway timeout.

Limits the vulnerability (CVE) reports to vulnerabilities published within the last number of days.

Limits the vulnerability (CVE) reports to vulnerabilities at or above this CVSS score (0 to 10).

Limits the vulnerability (CVE) reports to this severity and above: Critical, High or Medium.

Limits the vulnerability (CVE) reports to vulnerabilities for which an exploit is known to exist.

The most rows written to one worksheet of an Excel report; above it, the highest-risk rows are kept and the rest are left out of the workbook.

Tells Risk Analysis that Defender exposure graph tables are mirrored into Log Analytics, so reports needing them can run.

Address ranges that are reachable from the internet by design, such as a DMZ or an online landing zone. An asset with an address in them counts as internet exposed in the risk score.

When a finding counts as catch-up instead of being fixed in the monthly patch cycle: its fix was released (the month a "October 2026 Security Updates" text names -> that month's Patch Tuesday), or -- without one dated...

Reads the release date of each Microsoft update (by its KB number) from Microsoft's public Security Update Guide (api.msrc.microsoft.com, no sign-in), once a day, and keeps it in the install. Defender names the update...

Whether a Risk Analysis detailed run writes its results to an Excel workbook. The detailed results can hold millions of rows; they are in the web app.

Whether a Risk Analysis summary run writes its results to an Excel workbook (attached to the summary mail when it fits).

A large Risk Analysis report is asked from Microsoft Defender in parts. While one part is processed (risk scores, the database), the next parts are already asked, so Defender and SecurityInsight work at the same time....

Optionally removes devices not seen recently from the heavy attack-path Risk Analysis reports: off, lenient or strict.

The storage container in your staging storage account where the risk-analysis container jobs save their reports.

Storage URL where container-hosted Risk Analysis jobs save their report workbooks and data files.

The folder inside the report storage container where the risk-analysis container jobs save their reports.

Summary or Detailed, for the scheduled Summary report job; used only when the report template's name does not say which.

The report template the scheduled Summary risk-analysis container job uses.

Optional, at setup only: whether the Risk Analysis container jobs are made with the copy of their report rows to Log Analytics (SI_RiskAnalysis_Detailed_CL) switched on. SecurityInsight itself does not need it: its pa...

How much the Azure score counts in the overall risk score, relative to the other domains.

How much the endpoint score counts in the overall risk score, relative to the other domains.

How much the identity score counts in the overall risk score, relative to the other domains.

How much the public IP score counts in the overall risk score, relative to the other domains.

How heavily a Critical finding lowers the score in the management risk score (on a 0 to 10 scale, where 10 is the full penalty).

Sets how heavily a High (or Medium-High) severity finding counts in the Risk Analysis score columns used for management reporting.

Sets how heavily a Low severity finding counts in the Risk Analysis score columns used for management reporting.

Sets how heavily a Medium severity finding counts in the Risk Analysis score columns used for management reporting.

Sets how much more a finding on a Tier 0 (most critical) asset counts in the Risk Analysis domain and overall scores.

Sets how much a finding on a Tier 1 asset counts in the Risk Analysis domain and overall scores.

Sets how much a finding on a Tier 2 asset counts in the Risk Analysis domain and overall scores; the baseline the other tiers compare to.

Sets how much a finding on a Tier 3 (least critical) asset counts in the Risk Analysis domain and overall scores.

Tenant domain shown in report mail subjects and used in the Azure portal links Risk Analysis adds to findings on Azure resources.

Lets the trend engine compute and print its rollup without publishing anything.

Chooses whether the trend rollup is built from the Risk Analysis summary results or the detailed per-asset results.

How many weeks the printed weekly opened/closed view covers when the trend engine is run by hand with the weekly rate view.

Run-mode switch telling Risk Analysis to build the Summary report and use the Summary mail settings and table.

Also writes the Risk Analysis report as a JSON file next to the Excel file, for tools that read machine-readable data.

Marks a run as hosted on the vendor's internal automation platform, which provides the sign-in identity instead of SecurityInsight's own settings.

Older name for the data collection endpoint's ingestion address, used by Risk Analysis when sending results to Log Analytics.

Older name for the data collection endpoint that Risk Analysis sends its results through.

Older name for the resource group of the data collection endpoint used by Risk Analysis and setup checks.

Older name for the resource group holding the data collection rules that Risk Analysis uses.

Logs each split query's fingerprint and saves the query to a debug folder for troubleshooting.

Older name for the Azure region Risk Analysis uses when it has to create a missing workspace or ingestion resources.

Older name for switching e-mail of the Detailed Risk Analysis report on or off.

Older name for the recipient list of the Detailed Risk Analysis report.

Older name for switching e-mail of the Summary Risk Analysis report on or off.

Older name for the recipient list of the Summary Risk Analysis report.

Older name for the Shodan API key the public IP engine uses to look up your public IP addresses.

Prints the configuration risk analysis actually uses at start-up, so you can see which values are in effect.

Points the asset-profiling engine at a custom configuration file kept outside the standard config folder.

Logs the difference between a data collection rule's columns and the data being sent, on every ingestion call.

Stops the launchers from writing a run log (transcript) to disk and uploading it to storage.

A troubleshooting switch that saves every AI classification request to a file in the machine's temp folder.

Older name for the service principal's application id; still read when SI_SPN_AppId is not set.

Older name for the service principal's client secret; used only when SI_SPN_Secret is not set.

Older name for the Entra tenant id the service principal signs in to; used only when SI_SPN_TenantId is not set.

The client id of a user-assigned managed identity used to read Key Vault when no Azure sign-in exists yet. Older name for SI_ManagedIdentityClientId.

How many attempts the asset engines make for a Log Analytics query that fails with a temporary error.

Older name for the app id used to send data to Log Analytics; used only when SI_SPN_AppId is not set.

Older name for the object id of the ingesting service principal, used to grant it rights on data collection rules; used when SI_SPN_ObjectId is not set.

Older name for the client secret used to send data to Log Analytics; used only when SI_SPN_Secret is not set.

Older name for the Entra tenant id used to send data to Log Analytics; used only when SI_SPN_TenantId is not set.

Older switch to sign in with a managed identity, still honoured; SI_AuthMethod is the setting to use.

Caps how many public IP addresses are checked per run.

Test-only setting that pads the data Risk Analysis reads from your workspace with synthetic rows, to test behaviour at large scale on a small tenant.

Makes the profiling engines pass data between stages in memory instead of through the staging storage account.

A local folder where Risk Analysis writes its temporary query files and query error details.

The https address the status reports are sent to.

Client id of a user-assigned managed identity; the older name for SI_ManagedIdentityClientId, and the one container jobs and ingestion read.

Adds detailed diagnostic lines (routing, timing, merge statistics, samples) to the run log.

Thumbprint of the certificate in the local certificate store that the service principal signs in with; the recommended alternative to a client secret.

Application (client) id of the service principal the launchers sign in as; older name kept in step with SI_SPN_AppId.

Plain client secret the launchers sign in with when no managed identity, Key Vault secret or certificate is configured.

Name of the Azure Key Vault holding the service principal secret and other credentials; older name accepted alongside SI_KeyVaultName.

The Entra tenant id the launchers sign in to; older name kept in step with SI_SPN_TenantId.

Older name for the subscription Risk Analysis uses to find or create its workspace and ingestion resources.

Tells the launchers to sign in with the host's managed identity; set automatically by the sign-in method choice.

Requests a run that shows what would change without changing anything.

Older name for the Log Analytics workspace name, read by Risk Analysis and setup checks.

Resource group of the Log Analytics workspace, used by Risk Analysis when it must find or create the workspace.

Older name for the full workspace resource id, read by Risk Analysis when the newer setting is not set.

The Entra custom security attribute set that identity tagging rules write their tags into.

File name of your own asset tagging rules, loaded from the rules folder on top of the shipped rules.

File name of the shipped asset tagging rules in the rules folder.

Which asset tagging rules run, by the mode each rule is marked with: PROD, TEST, or both.

The folder the asset tagging engine reads its tagging rule files from.

How much SecurityInsight keeps about each asset: security (what SecurityInsight needs for risk) or full (all metadata from every source, kept a few days).

How much the full asset metadata collected from one source may change from one run to the next before the hand-off of that source is held.

Lets the asset-tagging script on a server (launcher.community-vm.ps1) write the tags its rules select in Defender, Azure and Entra on every run, instead of only reporting them.

Turns asset tagging on: the asset-tagging rules (for example Auto-CanBeOnboarded--Excluded--SI for the devices Defender can onboard) apply inside SecurityInsight, and the tagging job may run.

Lets container setup give the asset tagging job's own identity the rights it needs, including writing tags.

Name of the separate managed identity the asset tagging job runs as, so the collection identity stays read-only.

The Azure scopes, such as subscriptions or resource groups, where the asset tagging identity may write resource tags.

The second switch needed before the ServiceNow CMDB connector creates a CI.

Whether the ServiceNow CMDB connector only updates CIs it matched, or may also create CIs for assets it could not match.

A limit on how many assets one ServiceNow CMDB run handles, for trying the connector on a few assets first.

Whether the ServiceNow CMDB connector writes to your ServiceNow instance or only plans and reports what it would write.

Points the CMDB provider at your CMDB export CSV when it is stored outside the SecurityInsight folder, for example on a file share.

How long the cached CMDB data is reused before it is reloaded from the CSV at the start of a profiling run.

Makes the asset correlation compute and report its results without publishing them.

A limit on how many assets one correlation run reads, for troubleshooting.

Which data-out outputs SecurityInsight writes after each data sync: the Excel workbooks (CIs, findings, the findings summary, records) and the ServiceNow Import Set hand-offs. Each is a listed connector whose runs and...

The ServiceNow Import Set table the CI hand-off output (servicenow-ci) sends its rows to.

A one-time request for the ServiceNow outputs, carried out on the next sync: a full resync (every record in scope sent again as new, in one batch) or a test batch (at most 5 rows per output, which your importer never...

The ServiceNow import set table where SecurityInsight says when each push of a ServiceNow output starts (writing) and ends (complete, failed or held). Every data row carries the same batch id, so your importer imports...

The ServiceNow Import Set table the vulnerable item output (servicenow-vulnerable-item) sends its rows to.

Turns on enrichment of assets with data from your CMDB export (CMDB id, name, criticality, data sensitivity).

Marks the live ServiceNow CMDB as the asset-inventory (CMDB) source used to enrich profiled assets.

Lets the asset-tagging job actually write the tags its rules select in Defender, Azure and Entra, instead of only reporting them.

plan keeps every vulnerability connector in plan mode, whatever mode each connector has; it writes nothing.

Sends one mail a day with the vulnerabilities opened, closed and reopened in the last 24 hours, what is open now and the mean time to fix.

The time of day, in UTC, the daily vulnerability mail is sent.

The addresses that receive the daily vulnerability mail.

Sends mail through a relay that accepts mail without a user name and password.

The addresses that receive every Risk Analysis report that has no recipient list of its own.

Sends the report mail even when a run found nothing, as a sign the job ran.

Mails the Detailed Risk Analysis report after each run.

The addresses that receive the Detailed Risk Analysis report.

Mails the Summary Risk Analysis report after each run.

The addresses that receive the Summary Risk Analysis report.

Mails each Risk Analysis report, unless a report's own switch says otherwise.

Whether findings with an approved exemption count on the department pages and in the department mails.

Mails a person when a safety check holds, refuses or stops a step to protect your data -- for example when far more vulnerabilities would close than usual.

The addresses that receive the mail when a safety check holds, refuses or stops a step.

The shared mailbox SecurityInsight sends as. With an SMTP relay it is the From address (and wins over the older sender settings).

How SecurityInsight sends every mail: sharedMailbox = an Office 365 shared mailbox through Microsoft Graph as SecurityInsight's own identity (recommended); smtp = your own SMTP relay; none = no mail.

An ordinary mailbox OUTSIDE the shared mailbox's scope. Before it sends, SecurityInsight checks that it may NOT send as this mailbox -- which proves Mail.Send is restricted. Nothing is delivered by the check.

Who confirmed that Mail.Send is restricted to the shared mailbox (Test-ServicePrincipalAuthorization), and when. Used only when no other mailbox can be tested.

Says that your own SMTP relay is kept on purpose, so SecurityInsight stops suggesting the move to an Office 365 shared mailbox.

The largest Excel attachment, measured as encoded for mail, that a Risk Analysis mail carries; larger reports are mailed without the attachment.

The day of the month from which the report for the previous month is sent.

Sends each department's business owners a monthly mail with the status of their assets and services.

The lowest severity the technical owners' digest announces (Critical, High, Medium or Low).

How the technical owners' digest lists what is new: one row per vulnerability, or one row per asset with how many new findings it has and the highest severity.

After each data sync, sends each department's technical owners one mail with their new findings.

How many days ahead the daily task digest counts an open task as due soon.

Once a day, mails each person whose follow-up tasks are overdue, due soon or have a reminder today.

The day of the month from which the technical owners' review of the previous month is sent.

Sends each department's technical owners a monthly mail to review their findings.

Whether report e-mails are sent to the mail server over an encrypted (SSL/TLS) connection.

The From address on every mail.

Password (or app password) of the mail server account.

The network port of the mail server used for report e-mails, for example 25, 465 or 587.

Host name of the mail server (SMTP relay) every SecurityInsight mail is sent through.

User name of the mail server account that sends the mails.

Sets how recently an asset must have been seen (or an identity signed in) to count as active.

Path to your file of asset decisions: tier overrides, exceptions and exemptions applied during profiling.

Caps how many discovered Azure resources the Azure engine processes in one run, for testing.

Caps how many discovered devices the endpoint engine processes in one run, for testing.

Caps how many discovered users and service principals the identity engine processes in one run, for testing.

Caps how many public IP addresses the public IP engine processes in one run, for testing.

Azure resource types from the exposure graph that are settings on other resources, not assets, and are left out of Azure collection.

Fixes which Azure resource types are read from the Defender exposure graph, the Azure engine's main source.

Extra Azure resource types the Resource Graph source leaves out, on top of the built-in list of noisy types.

Which exposure graph relationship types count as an identity having access to an Azure resource.

Which exposure graph node types are treated as identities when mapping who can access Azure resources.

Which exposure graph node types are treated as Azure resources for extra exposure details and access mapping.

A safety cap on how many resources the Azure engine pulls from Azure Resource Graph in one run.

Restricts the Azure Resource Graph source to a hand-picked list of resource types.

Subscription names (wildcards allowed) skipped when the identity engine scans Azure role assignments.

Whether the Azure engine also collects every unhealthy Defender for Cloud recommendation into its own table for the Risk Analysis reports.

Whether disabled users, service principals and managed identities, and disabled computers are collected from the sources. Disabled means the account is disabled in its own directory (Entra accountEnabled false, AD acc...

Whether connectors and exports send disabled users, service principals, managed identities and computers out of SecurityInsight (ServiceNow, Jira, risk register, CMDB, data exports).

Whether disabled users, service principals, managed identities and computers take part in the correlation that builds configuration items (CIs).

Whether the Risk Analysis reports include disabled users, service principals, managed identities and computers.

Whether the finding and vulnerability lifecycle acts on disabled assets: opening, resolving and closing findings, the close-loop mail and opening or closing tickets.

Stops the Azure engine from giving an Azure VM or Arc machine the same tier as its matching Defender device.

Above this many identities of one kind, the identity engine reads the exposure graph in several smaller queries instead of one.

Lets the identity engine add sign-in statistics per user, such as sign-in counts, apps, IP addresses and countries.

Remembers each asset between runs so incremental runs can skip assets that are not yet due for re-processing.

Makes every asset-profiling engine process all assets on the next run, ignoring the per-asset skip schedule and cached CMDB data.

Makes the Azure engine reprocess every resource instead of skipping ones that have not changed since the last run.

Makes the endpoint engine reprocess every device instead of skipping ones that have not changed since the last run.

Makes the identity engine reprocess every identity instead of skipping ones that have not changed since the last run.

Makes the public IP engine process every address, ignoring the per-tier re-check cadence, for this engine only.

How many minutes of each 15-minute run of its own job (caj-si-signin-methods) the background read of the users' sign-in methods may use.

How old a user's full sign-in method detail may get before the background read reads that user again, even when the registration report says nothing changed (it also catches changes the report does not show, such as a...

Which users get their sign-in methods read in full: every method with its details (phone number and type, e-mail address, Microsoft Authenticator app and version, FIDO2 key or passkey model and attestation, Windows He...

A customer's choice for groups the Exposure Graph still lists although Entra ID no longer has them (neither active nor in its deleted items). On, only groups that still exist in Entra ID (active or recently deleted) b...

A customer's choice for on-premises Active Directory accounts that the Exposure Graph lists but that were never synced to Entra ID (no Entra object id). On, only the privileged ones become assets, whether they are ena...

A customer's choice for on-premises Active Directory accounts that the Exposure Graph lists but that were never synced to Entra ID (no Entra object id). On, only the enabled or privileged ones become assets: privilege...

Whether the identity engine includes Microsoft's own built-in service principals in its inventory.

Turns off the filter that leaves out stale or offboarded devices, so every known device is published.

Turns off the one identity filter left: Microsoft-published applications this tenant granted nothing. Every user (disabled accounts and guests too) and every service principal and managed identity the tenant owns is a...

Lets the profiling engines also load draft posture rules proposed by schema discovery, before anyone has reviewed them.

Chooses where the engine finds public IP addresses to check: classified assets (profile-cl), Azure and Defender inventory (arg-eg), or both (union).

A list of additional public IP addresses to check every run, such as partner or supply-chain addresses.

Narrows the endpoint inventory to devices that Defender for Endpoint reports as active or recently seen.

Restores the older, stricter rule that an identity must have signed in recently to be published.

List of Defender advanced-hunting tables whose columns schema discovery checks for new fields.

The Shodan API key used to look up what is exposed on your public IP addresses.

Asks Shodan to actively re-scan your addresses before reading results, instead of using only data Shodan already has.

The minimum time between two fresh Shodan scans when fresh scans are on.

Where the engine records when the last fresh Shodan scan finished.

How far back the engine looks in the endpoint and Azure profile tables to find classified assets with public IPs.

Where the engine remembers a submitted Shodan scan that has not finished yet.

How often the engine checks whether a submitted fresh Shodan scan has finished.

How long one run waits for a submitted fresh Shodan scan to finish.

Limits endpoint-derived public IPs to servers, because a workstation's public IP is usually a home or mobile network you do not own.

Pause between live Shodan lookups so the engine stays within Shodan's rate limit.

Checks public IPs only for assets at or below this privilege tier (0 is most critical).

How long each Shodan lookup or scan submission may take before it is abandoned.

How long a stored Shodan result is reused before the address is looked up again.

A safety ceiling on the Shodan scan credits spent per month, by per-address on-demand scans and by the batch fresh scan.

How many users are looked up in one sign-in log query during identity sign-in enrichment.

How many days of sign-in and device logon history the identity and endpoint enrichment look back over.

How often an asset whose privilege tier is not yet known is re-processed when the per-asset skip schedule is in use.

How often tier 0 assets (domain controllers, break-glass and global admins) are re-processed when the per-asset skip schedule is in use.

How often tier 1 assets (production servers, privileged users) are re-processed when the per-asset skip schedule is in use.

How often tier 2 assets (workstations, regular users) are re-processed when the per-asset skip schedule is in use.

How often tier 3 assets (test and development, externals, guests, unmanaged) are re-processed when the per-asset skip schedule is in use.

In Consistent mode, chooses which report (Summary or Detailed) builds the AI summary, risk score and top list that the other report reuses.

How old the leading report's saved summary may be before the other report stops reusing it and builds its own.

Chooses whether the Summary and Detailed reports show identical AI summary, risk score and top list, or each shows its own figures.

The bands of the key figures' table "Age of open CVE findings": one row "older than N days" per number, separated by commas.

Which fixed vulnerabilities the key figure "Mean time to fix" averages: those remediated within this many days before the collection.

The window of the key figures "Vulnerabilities opened in the last N days" and "Vulnerabilities fixed in the last N days" (the Executive overview, the Executive report and the management mail).

When the key figure "Privileged accounts without a sign-in for N days" counts an enabled, active privileged account: its last sign-in is longer ago than this.

The named views SecurityInsight ships for Security recommendations, Summary and Detailed (Critical and High, On Tier 0, Vulnerabilities (CVE), Known exploited, MITRE, Compliance, CVSS) that are hidden from the view pi...

The protection score's accepted lifecycle for cloud resources (Azure): how many days a Very High or High finding may be open before it counts in the "within Accepted Lifecycle" view.

The protection score's accepted lifecycle for devices: how many days a Very High or High finding may be open before it counts in the "within Accepted Lifecycle" view.

The protection score's accepted lifecycle for identities: how many days a Very High or High finding may be open before it counts in the "within Accepted Lifecycle" view.

The protection score's accepted lifecycle for public IP addresses: how many days a Very High or High finding may be open before it counts in the "within Accepted Lifecycle" view.

How many days a Very High or High finding on a cloud resource that is not a patch (an Azure / Defender for Cloud recommendation, an attack path) may be open before it counts in the "within Accepted Lifecycle" view.

How many days a Very High or High device finding that is NOT a patch (a configuration, an attack path, a vulnerability with no vendor fix) may be open before it counts in the "within Accepted Lifecycle" view.

How many days a Very High or High identity finding (MFA, roles, sign-ins, attack paths -- anything that is not a patch) may be open before it counts in the "within Accepted Lifecycle" view.

How many days a Very High or High finding on a public IP that is not a patch (an open port, an exposed service) may be open before it counts in the "within Accepted Lifecycle" view.

The finding severities that take an asset out of good standing in the protection score.

How much an asset of each tier weighs in the protection score, Tier 0 to Tier 3, separated by commas.

Risk Analysis reads Defender for Endpoint's software vulnerabilities export once per run for the first time each CVE was seen on each device (si_source_first_seen).

How many days the full asset metadata is kept, in Log Analytics and in the Pro database.

The least number of days an asset must go unseen before its CI is retired -- in the CI table and in the state handed to ServiceNow. A brake under every other rule: whatever decided the retirement (the grace period, th...

Retires an asset at once when Azure PROVES its resource was deleted: a Delete in Azure Resource Graph's resource changes (the last 14 days). Merely missing from a list is never proof -- it keeps the not-seen grace per...

Retires an asset at once when Entra ID PROVES its object was deleted: the user, device or group is in Entra ID's deleted items. Merely missing from a list is never proof -- it keeps the not-seen grace period.

Retires an asset at once when Intune PROVES its managed device was deleted: a successful Delete of the managed device in Intune's audit events. Merely missing from a list is never proof -- it keeps the not-seen grace...

Whether findings covered by an approved exemption are counted in the management numbers: Risk Analysis's workbook, JSON, summary and mail, and the web app's dashboards, KPIs, trends, closure and Services view and the...

Optionally copies the provider records (every object a collection reads, mapped to SI fields) to Log Analytics, for Azure Monitor or your own workbooks.

How many days run logs are kept, both on the local disk and in the storage account, before being deleted.

Chooses how much detail is kept per asset: everything collected (cmdb) or only the columns the schema declares (security).

How many days an asset SecurityInsight no longer sees may stay unseen before it is retired: its open vulnerabilities close as AssetRetired (never as fixed), its CI in the CI table is retired, and ServiceNow gets the s...

The grace period for other Azure resources -- any Azure resource that is not a virtual machine. Overrides the general value for this category.

The grace period for Azure virtual machines -- an Azure virtual machine or scale set, also when Defender reports it as a device. Overrides the general value for this category.

The grace period for client PCs -- a device whose operating system is not a server (laptops, desktops). Overrides the general value for this category.

The grace period for servers -- a device with a server operating system, or an Arc-connected machine. Overrides the general value for this category.

The grace period for service principals -- an Entra service principal or managed identity. Overrides the general value for this category.

The grace period for users -- an Entra user account. Overrides the general value for this category.

How many months the Pro audit trail (every action in the web app, the jobs and setup: who, when, why, before and after) keeps its rows.

How many days the change history of each configuration item (CI) is kept in the Pro database.

How many days of each CI's daily trend (risk score, open findings by severity) the Pro database keeps.

Makes the SQL CMDB connector plan what it would create, update and retire without writing anything to SQL.

Writes every asset SecurityInsight knows into a CI table in the Pro database (one row per asset with its tier, department, owner, business services, identifiers and change history), for reporting and Power BI.

Which kinds of asset the SQL CMDB connector writes to the CI table: endpoint (devices), azure (Azure resources) and publicip (public IP addresses).

How many complete runs in a row an asset must be missing before the SQL CMDB connector retires its CI.

How recently an asset's profile must have been published for the SQL CMDB connector to count the asset as present.

How many days the configuration backups are kept (the daily backup and Back up now).

How many days the change journal keeps its rows -- every configuration change, record by record, that undo and restore are built on.

How many days back in Log Analytics the Pro data sync looks for complete runs it has not copied yet.

How many days of run data (findings, assets, daily aggregates) the Pro database keeps before older collections are removed.

The SQL database the Pro data sync writes run data to, when it should differ from the Pro settings database.

The SQL server the Pro data sync writes run data to, when it should differ from the Pro settings database's server.

Makes the Pro data sync plan what it would copy and purge without writing anything to SQL.

How many days a critical finding has to be fixed, counted from when it was first found (or found again after it was fixed).

How many days a high finding has to be fixed, counted from when it was first found (or found again after it was fixed).

How many days a low finding has to be fixed, counted from when it was first found (or found again after it was fixed).

How many days a medium finding has to be fixed, counted from when it was first found (or found again after it was fixed).

How many days a closed finding's lifecycle row (first detected, closed, close reason) is kept in the Pro database.

Lets the daily mail job plan every finding that has no governance status yet and whose department's remediation flow is 'Auto in the maintenance window' for that department's next maintenance window.

The department that receives every asset no override, tag or rule places.

When an open vulnerability counts as overdue in the business owners' monthly report, counted from when it was first seen.

Where SecurityInsight looks to decide which department is responsible for an asset: the platform tags (tags) and the department rules defined on the web app (rules), in the order listed.

The tag names whose value names the responsible department: Azure resource tags (and the subscription's), Defender device tags written as Name:Value, and the Entra Department attribute.

Optional. After each Risk Analysis Detailed run, copies the de-duplicated findings (one row per CI and finding) into your Log Analytics workspace, for your own workbooks, Sentinel or KQL. SecurityInsight itself does n...

Chooses where the Azure collection writes its results: Log Analytics (LA), JSON files and/or Excel files.

Chooses where the endpoint collection writes its results: Log Analytics (LA), JSON files and/or Excel files.

Chooses where the identity collection writes its results: Log Analytics (LA), JSON files and/or Excel files.

Chooses where the public IP collection writes its results: Log Analytics (LA), JSON files and/or Excel files.

Whether the large database writers (Risk Analysis storing its findings, the data sync preparing the views, the removal of old collections) look at how busy the database is before each batch.

The database load (the highest of log write, data reads and CPU, in percent of what its tier allows) above which the large writers slow down.

The database load below which the large writers go back to their full pace after they slowed down.

Whether the install sends Invardia one status report a day and one short report per engine run: which engine ran, whether it ended ok, with warnings or failed, how long it took, the stage and the kind of error. Commun...

Pro installs with an install key can send Invardia this install's own links -- the web app's and the MCP server's addresses -- with the daily status report, so every mail Invardia sends about this environment carries...

Pro installs with an install key send Invardia the daily data health result -- the state and, per source and report, how many records were checked, found, missing and different. Counts only: no names, ids or values.

Pro installs with an install key send Invardia one setup report a day: a list of critical settings (updater, update ring, install key, licence, mail, permissions, last run, backup) with ok / missing / wrong / unknown,...

How many complete runs in a row a vulnerability must be missing from an asset that was seen before the close-loop marks it fixed.

Name of the data collection rule used to send the asset-tagging activity log to Log Analytics.

Log Analytics table receiving the asset-tagging activity log: which tags were or would be applied or removed.

Chooses how SecurityInsight signs in to Microsoft services: managed identity, service principal with certificate, or service principal with client secret.

The Azure subscription in which the engines look up and create the data collection endpoint and rules.

Name of the data collection rule the Azure profiling engine sends its results through.

Log Analytics table the Azure profiling engine writes its asset profiles to.

Name of the data collection rule used to send Defender for Cloud recommendations to Log Analytics.

Log Analytics table that receives Defender for Cloud recommendations collected with the Azure engine.

Name of the Azure Container Registry that holds the SecurityInsight container image; container setup creates it if it does not exist.

Name of the Azure Container Apps environment the SecurityInsight jobs run in; container setup creates it if it does not exist.

The tag of the container image that setup builds and every scheduled job runs.

The Azure region where container setup creates the registry, environment and identities.

The Azure resource group where container setup creates the registry, environment, identities and jobs.

Lets container setup reuse the image already in the registry instead of building a new one.

The size (Azure SQL service objective) of the Pro database. Allowed values: S1, S2, S3, S4, S6, S7, S9, S12. Empty = the product's rule.

The Azure subscription the SecurityInsight containers are installed in, saved by setup so later updates and upgrades work in the same subscription.

Makes all container jobs sign in as the app registration (service principal) with its client secret instead of a managed identity.

Makes all container jobs sign in as one user-assigned managed identity, said explicitly.

The CPU of the web app's own container: 0.5 to 4, in steps of 0.25. Empty = the product's size.

The memory of the web app's own container, for example 4Gi. Empty = twice the web app's CPU.

The ingestion address of the data collection endpoint that Risk Analysis sends results to.

Name of the data collection endpoint all engines send their data to Log Analytics through.

The resource group that holds the data collection endpoint used to send data to Log Analytics.

The pattern used to name each collection engine's data collection rule, where {0} is replaced by the engine name.

Resource group holding the data collection rules (and, by default, the endpoint) used to send data to Log Analytics.

Full resource id of a separate Log Analytics workspace holding Defender data, when it is not the SecurityInsight workspace.

The name of the data collection rule the endpoint engine sends its asset rows through to Log Analytics.

The Log Analytics table the endpoint engine writes its asset rows to.

The name of the data collection rule the identity engine sends its rows through to Log Analytics.

The Log Analytics table the identity engine writes its rows to.

Whether SecurityInsight Pro takes its updates from Invardia by itself. Every night the updater job asks Invardia for the release approved for this installation's ring, checks its signature and contents, and applies it...

Whether new template packs wait for you. Between releases SecurityInsight ships template packs: reports and rules for data that Microsoft added to Defender and the Exposure Graph, such as a new attack-path type, and u...

The one Key Vault SecurityInsight reads its secrets from: the sign-in secret, integration credentials and a Pro licence.

Whether SecurityInsight Pro asks Invardia for its licence by itself. Every night the updater job checks the licence; when there is none, it ends within 30 days, or it is in its grace period, the job asks Invardia for...

The address of the licence service that a manual licence request contacts. Must be an https address.

The email address the licence provider may use to contact you about a manual licence request.

The edition you ask for when requesting a licence by hand. The licence provider decides what is granted.

The Azure region setup creates the workspace, endpoint, storage and container resources in. A collection run creates no Azure resource, so it does not need it.

Client id of a user-assigned managed identity to sign in with when the sign-in method is managed identity.

Names the data collection rule the public IP engine sends its results through.

Names the Log Analytics table the public IP engine writes to.

The storage container holding the shared top-50 risk summary, so several hosts or containers reuse one summary instead of each building it.

The file path, inside the container, of the shared top-50 risk summary that several hosts or containers reuse.

Makes the authentication setup script re-read service principal credentials from Key Vault and rewrite them, even when they are already in the configuration file.

The data collection endpoint address risk analysis sends its results to in Log Analytics.

Names the data collection endpoint risk analysis uses for its Log Analytics results.

The name of the data collection rule the detailed Risk Analysis rows are sent through to Log Analytics.

The name of the data collection rule the summary Risk Analysis rows are sent through to Log Analytics.

Resource group holding the data collection rules Risk Analysis uses to send its results to Log Analytics, when it should differ from the solution-wide one.

Name of the Log Analytics table that receives rows from the Detailed Risk Analysis report.

Name of the Log Analytics table that receives rows from the Summary Risk Analysis report.

Name of the Log Analytics workspace Risk Analysis writes its results to, when it should differ from the solution-wide workspace.

Resource group used to find or create the Risk Analysis workspace when it is given by name.

Full resource id of the Log Analytics workspace Risk Analysis writes to and reads collected data from, overriding the shared workspace.

Name of the data collection rule schema discovery uses to send its catalog of found data fields to Log Analytics.

Log Analytics table receiving the schema catalog: new data fields, relationships and draft proposals found by schema discovery.

Application (client) id of the service principal the engines sign in as when not using managed identity.

Which Windows certificate store (LocalMachine or CurrentUser) holds the sign-in certificate of the service principal.

Thumbprint of the service principal's certificate, with its private key in the certificate store, used for certificate sign-in.

Object id (not app id) of the service principal, used to grant it rights on data collection rules and storage.

Client secret of the service principal when the sign-in method is Secret.

The Entra tenant the service principal signs in to, for data reads and Log Analytics ingestion.

The storage account the collection engines use for staging data, caches, the shared catalog and the identity ledger.

Names the Azure resource group that holds the SecurityInsight storage account. Setup creates the account and grants its permissions there; a collection run only checks that the account is there.

The pattern used to name each collection engine's Log Analytics table, where {0} is replaced by the engine name.

The name of the data collection rule the trend engine publishes its daily rollup through.

Whether the update gives this installation's directory objects the names a new installation gets: the engine's application "SecurityInsight Engine", the web app's sign-in application "SecurityInsight" and the SQL admi...

The update ring this installation belongs to: 0 = development, 1 = internal test, 2 = early release, 3 = broad. It is shown in the header (UPDATE RING) and recorded with the installation, so the ring is known from the...

Name of the Log Analytics workspace SecurityInsight writes its data to and reads from.

Names the Azure resource group of the Log Analytics workspace the engines write to.

Full Azure resource id of the Log Analytics workspace all engines write to and query.

Name of the Key Vault secret that holds the service principal's client secret.

The list of engines container setup creates scheduled jobs for.

The most worker containers that may run at the same time per engine when queue-driven scaling is on.

How many containers the Azure profiling job runs side by side in each run.

How many containers the endpoint profiling job runs side by side; also used for jobs that have no parallel setting of their own.

How many containers the identity profiling job runs side by side in each run.

How many containers the schema discovery job runs side by side in each run.

How many Risk Analysis queue workers may run Detailed reports at the same time.

Runs the Risk Analysis Detailed reports on queue workers, several reports at the same time, instead of one after another in one job.

When the asset tagging container job runs, as a cron expression in UTC.

When the Azure profiling container job runs, as a cron expression in UTC.

Schedule (cron, UTC) of the container job that backs up your configuration once a day.

When the endpoint profiling container job runs, as a cron expression in UTC; also used for jobs without a schedule of their own.

When the identity profiling container job runs, as a cron expression in UTC.

When the Summary risk-analysis container job runs, as a cron expression in UTC.

When the schema discovery container job runs, as a cron expression in UTC.

Schedule (cron, UTC) of the container job that builds the asset trend; it should run after the Detailed report.

Makes container setup start each job once immediately after creating or updating it.

Runs the collection engines as queue-driven workers that scale from zero with the amount of work, instead of one scheduled job each.

The CI build (correlation) rebuilds only the CIs whose input changed since their last build: a record new, changed, moved or gone, a link state, a time threshold, an identity anchor or a manual override. Every CI is r...

How long the rules of one asset may take in the CI build (correlation) before the build goes on with the next asset. Applying the rules to one asset normally takes milliseconds; an asset with unusually large data coul...

The time of day a new install's daily pipeline (Collect, Correlate, Deliver) starts, in the pipeline's time zone.

The time zone the daily pipeline's start time is read in.

Whether a Risk Analysis summary run writes the day's risk trend row itself, from the rows it has just published.

Every day SecurityInsight checks its own data: a random 10% of each source's records (at least 50) are read from the source and looked up in the newest collection, and a random 10% of the devices with vulnerability fi...

How many of the checked Azure resources may be missing from the newest collection or differ from Azure before the day counts as anomalous, as a percent of the resources checked (never fewer than the minimum records be...

How many of the checked resources with Defender for Cloud recommendations may be missing from the newest collection or have a different number of open recommendations before the day counts as anomalous, as a percent o...

How many of the checked Defender for Endpoint devices may be missing from the newest collection or differ from Defender before the day counts as anomalous, as a percent of the devices checked (never fewer than the min...

How many of the checked Entra apps and service principals may be missing from the newest collection or differ from Entra before the day counts as anomalous, as a percent of those checked (never fewer than the minimum...

How many of the checked Entra users may be missing from the newest collection or differ from Entra before the day counts as anomalous, as a percent of the users checked (never fewer than the minimum records below).

Per Risk Analysis report with vulnerability findings: how many of the checked findings may differ from what Defender reports now (missing, or no longer reported) before the day counts as anomalous, as a percent of tho...

How many of the vulnerabilities Defender reports for the checked devices may be missing from SecurityInsight's findings before the day counts as anomalous, as a percent of those vulnerabilities (never fewer than the m...

The fewest differences any data health margin allows, whatever its percent -- so a small source does not turn the data Unhealthy over one or two records.

The safety check that protects the asset metadata handed to your CMDB and vulnerability system: The full asset metadata collected from one source changed by more than the allowed share since the previous run, which lo...

Whether this safety check sends a mail when it trips.

The safety check that protects the audit trail: The audit trail retention setting (SI_Pro_AuditRetentionMonths) is not a whole number of at least 13 months, so nothing was removed.

Whether this safety check sends a mail when it trips.

The safety check that protects your configuration items (CIs) from being written by two builds at the same time: A CI build was started while another CI build was still running.

Whether this safety check sends a mail when it trips.

The safety check that protects the CIs your ServiceNow imports from the CMDB hand-off database: Far more of the CIs handed to ServiceNow last time are missing from this run than the connector allows, which looks like...

Whether this safety check sends a mail when it trips.

The safety check that protects the configuration items (CIs) in ServiceNow: ServiceNow's import did not accept some of the CIs SecurityInsight sent, so this batch was not completed.

Whether this safety check sends a mail when it trips.

The safety check that protects the placement of assets in your business services: The service model has errors, so no asset was placed in a business service.

Whether this safety check sends a mail when it trips.

The safety check that protects the configuration items (CIs) in ServiceNow: The ServiceNow instance could not be reached, so nothing was sent.

Whether this safety check sends a mail when it trips.

The safety check that protects the configuration items (CIs) in your SQL CMDB table: SecurityInsight sees far fewer assets than are active in the CMDB table, which looks like a broken collection rather than assets gon...

Whether this safety check sends a mail when it trips.

The safety check that protects the configuration items (CIs) in your SQL CMDB table: The newest asset collection holds no assets at all, so nothing was written or retired.

Whether this safety check sends a mail when it trips.

The safety check that protects the configuration items (CIs) in your SQL CMDB table: The asset correlation results are missing, so assets could not be matched to their CIs and nothing was written.

Whether this safety check sends a mail when it trips.

The safety check that protects the configuration items (CIs) in your SQL CMDB table: The newest asset collection is not known to be complete, so the CMDB table was not changed.

Whether this safety check sends a mail when it trips.

The safety check that protects the configuration items (CIs) in your SQL CMDB table: Another run changed the CMDB table while this one was planning, so this run wrote nothing.

Whether this safety check sends a mail when it trips.

The safety check that protects your configuration items (CIs) and everything calculated from them: One source returned far fewer assets than in its last good collection, although the collection completed.

This safety check never sends a mail: it accepts a real drop by itself on the next complete collection, so its event is shown on the Guards page only. This switch changes nothing and is not shown on the Settings page.

The safety check that protects the asset kind filters of the Pro web app: findings of an asset kind were loaded, but their assets were stored without that kind (or without any kind), so the asset kind filter cannot sh...

Whether this safety check sends a mail when it trips.

The safety check that protects the collections shown in the Pro web app: Some Risk Analysis collections were not loaded into the Pro database because the run that produced them is not known to be complete.

Whether this safety check sends a mail when it trips.

The safety check that protects the days shown in the Pro web app and its trends: Risk Analysis data arrived without its key columns (its finding ids, or its collection time), so it was not loaded as a day.

Whether this safety check sends a mail when it trips.

The safety check that protects the collections shown in the Pro web app: A collection could not be read or written in full, so it was not loaded.

Whether this safety check sends a mail when it trips.

The safety check that protects your findings from being exempted in bulk by mistake: A request to exempt or change many findings at once was refused (no narrowing filter, or more findings than the limit allows).

Whether this safety check sends a mail when it trips.

The safety check that protects the order of the daily jobs: A scheduled start of the daily job flow was held because the previous run was still running; it ran once as soon as that run finished.

Whether this safety check sends a mail when it trips.

The safety check that protects the jobs that depend on an earlier job: A job in the daily flow was interrupted and was not started again automatically.

Whether this safety check sends a mail when it trips.

The safety check that protects the jobs that depend on an earlier job: One or more jobs in the daily flow were skipped because a job they need did not succeed.

Whether this safety check sends a mail when it trips.

The safety check that protects the jobs of the daily flow: A job in the daily flow could not start: its container stopped before SecurityInsight ran (an Azure platform problem).

Whether this safety check sends a mail when it trips.

The safety check that protects the results written to your Log Analytics workspace: Not every row of a result was accepted by Log Analytics, so the run was stopped instead of reporting a partial result as complete.

Whether this safety check sends a mail when it trips.

The safety check that protects a job from running twice at the same time: A job was started while its previous run was still running, so the new run did nothing.

Whether this safety check sends a mail when it trips.

The safety check that protects the data of a job that Microsoft keeps throttling: A job has not completed for a long time, because Microsoft throttled every run of it.

Whether this safety check sends a mail when it trips.

The safety check that protects the SecurityInsight Pro features: The SecurityInsight Pro licence is in its grace period.

Whether this safety check sends a mail when it trips.

The safety check that protects the SecurityInsight Pro features: The SecurityInsight Pro licence does not verify (it has expired or is not valid for this install), so the Pro jobs did not run.

Whether this safety check sends a mail when it trips.

The safety check that protects the speed and correctness of your Risk Analysis reports: One or more reports needed far more buckets (query slices) than usual.

Whether this safety check sends a mail when it trips.

The safety check that protects the completeness of your Risk Analysis reports: One or more report columns are empty (or gone) while they had values in the previous run.

Whether this safety check sends a mail when it trips.

The safety check that protects the completeness of your Risk Analysis reports: One or more reports produced far fewer findings than the previous run.

Whether this safety check sends a mail when it trips.

The safety check that protects your SecurityInsight database: A database change was refused because it is not approved for this install, or because it could remove data.

Whether this safety check sends a mail when it trips.

The safety check that protects your SecurityInsight installation from running a new version on an old database: An update stopped before it changed anything, because the new version's database changes could not be app...

Whether this safety check sends a mail when it trips.

The safety check that protects open vulnerability records: SecurityInsight would have closed far more vulnerability records in one run than it allows, so it closed none.

Whether this safety check sends a mail when it trips.

The safety check that protects open vulnerability records: Far fewer of the open vulnerability records are still reported than usual, which looks like a partial collection rather than a real fix, so nothing was closed.

Whether this safety check sends a mail when it trips.

The safety check that protects open vulnerability records: The newest Risk Analysis results held no vulnerabilities while records are still open, so nothing was closed.

Whether this safety check sends a mail when it trips.

The safety check that protects your vulnerability target: A vulnerability connector is not set up completely, so it did not run.

Whether this safety check sends a mail when it trips.

The safety check that protects open vulnerability records: The Risk Analysis run behind these results did not finish cleanly, so nothing was closed.

Whether this safety check sends a mail when it trips.

The safety check that protects open vulnerability records: The scope of the collection changed, so records that dropped out of it were not closed.

Whether this safety check sends a mail when it trips.

The safety check that protects open vulnerability records: The newest Risk Analysis results are not known to be complete, so findings were opened and updated but nothing was closed.

Whether this safety check sends a mail when it trips.

The safety check that protects your vulnerability target from duplicate records: The vulnerability target (for example the ServiceNow table) could not be read in full, so nothing was written: every record the read mis...

Whether this safety check sends a mail when it trips.

One switch for every safety check that holds, refuses or stops a step to protect your data (the list below and the Guards page).

When the assets of a source (Defender for Endpoint, Entra ID, Azure, public IPs) or the active CIs fall this many percent or more below the median of the last 3 runs, it is shown as a data-quality warning.

When the share of rows that carry a key value -- the probability and consequence risk factors, the tier, the SQL tag, and the CIs' asset type and owner -- falls this many percentage points or more below the median of...

One mail a day when a key number of the latest pipeline run is far off its usual range -- for example far fewer assets, a report with no rows, or risk factors suddenly missing.

The addresses that receive the daily data-quality mail.

When a Risk Analysis report has 0 rows, or falls this many percent or more below the median of the last 3 runs, it is shown as a data-quality warning -- the sign of a query that suddenly returns nothing.

When the active CIs in a tier (0 to 3) change by this share of all active CIs or more compared with the median of the last 3 runs -- or the CIs about to retire rise by it -- it is shown as a data-quality warning. The...

A one-time clean-up of the finding history. Before a fix of October 2026, a finding that no CI held could be closed as no longer monitored when it had only moved to a CI, and such a finding could stay open under its o...

On a new install's first collection, a step that fails or is stopped is started again at once and carries on from what it finished, this many times. After that the run ends with a warning that names the step and who m...

When the correlation or Risk Analysis fails after the collections completed, the data sync and the verification still run on what is stored, so the web app shows what was collected instead of nothing. The run is marke...

Every page shows one run: the last run that completed in full. A run in which a report could not be completed and fell back to its last complete result is not shown by default -- the pages keep the last complete run,...

What happens when a source's collection completes with far fewer assets than its last good collection (down by the data-quality asset drop limit or more). That can be a real clean-up, for example many Azure resources...

When the collection of one source (identities, Azure resources, endpoints, the public IP scan) fails, the run goes on with that source's last good collection and says how old it is. When a source has had no good colle...

How long a job may keep being throttled by Microsoft, without completing, before the one "stuck" alert is sent.

How many throttled runs in a row, without one that completes, send the one "stuck" alert.

The share (0 to 1) of the open vulnerability records the newest results must still report before anything may close.

An optional limit on HOW MANY vulnerability records the connector may close in one run, on top of the share above.

The largest share of the open vulnerability records the connector may close in one run before it holds the closes for an Admin to release.