Overview
Compliance posture and database-engine state
Risks
View all →By Service
Click any service to view its resources in the inventory.Engine State
Live status reported by each database engine — distinct from compliance posture.
Compliance Posture by Framework
Pass rate per enabled framework, derived from the latest evaluator run — the same basis as the Compliance Posture figure above and the Controls page. Findings marked “Not applicable” and controls requiring manual attestation are excluded from the denominator; findings awaiting a sensitive-data scan count against pass%. A control cited by several frameworks is counted once in each, so a framework’s total can exceed the fleet total.
Vulnerability Assessment
View all →Patch currency is the authoritative signal — databases behind the latest AWS-published engine version, plus known-CVE exposure.
Inventory
Summary & charts
Controls
Risks
What is actually exposed, worst first. A risk is a gap on a specific database — public access, no encryption, no audit trail, no backups, weak authentication, a vulnerable engine. Gaps on a database that also holds sensitive data are ranked highest, because those are the ones that turn into a breach. A well-protected database full of SSNs has nothing to fix, so it does not appear here.
Vulnerabilities
Patch currency is the authoritative signal — a resource that is minor versions behind the latest AWS-published engine version should be upgraded to the recommended target. The CVE list per resource is the supporting evidence; CVEs on managed RDS engines are candidate matches (AWS may have backported the fix).
Reporting
Settings
API endpoint
The URL the dashboard reads from. Useful for scripting against the same data the UI shows.
—
Inventory collector schedule
How often the inventory of databases is refreshed across every enrolled account. Pick a preset — Custom reveals an EventBridge expression input for fine control.
Regions
Regions where your databases are discovered and connected to. Failures in one region don't prevent scans in others.
Data sensitivity (DSPM) scans
Enable scheduled DSPM-Lite classification across every database with a saved connection profile. Connect populates schemas + db_users only — DSPM samples cell values to classify PII / PCI / PHI / secrets and is the heavy workload. Manual point-in-time scans via the per-database Run DSPM scan button are always allowed regardless of this toggle.
Vulnerability assessment (VA)
Schedule per-resource vulnerability assessments. Each assessment computes a patch-currency signal (how many minor versions behind the latest AWS-published engine version a resource is) plus a supporting CVE list from upstream NVD data. Min severity controls the lowest CVSS tier surfaced in rollups.
Custom DSPM classifiers
Per-tenant regex classifiers that run alongside the built-in Presidio pack on every DSPM scan. Use these for identifiers Presidio doesn't ship — internal employee IDs, customer account numbers, ticket codes. Operators and Admins can author; SecurityReader is read-only.
Custom frameworks
Per-tenant compliance frameworks that aren't in the shipped catalog. Author internal control sets, regulatory regimes we don't ship yet, or house-rule overlays — findings credit the same canonical-check pipeline as built-in frameworks, but appear with a Custom badge so auditors can tell them apart. Operators and Admins can author; SecurityReader is read-only.
Risk & severity tuning
Tenant tuning for the severity model. The unified model exposes two families: a control's intrinsic base weight (1–4) and the data-tier weights (how much regulated / crown-jewel data escalates a finding). Every overridden value renders a Custom badge; a one-click reset returns a row to the shipped default. Admin-only — re-weighting changes the whole fleet's posture; Operator / SecurityReader are read-only.
Control base weight
Data-tier weights
DSPM classifier packs
Which Presidio entity packs DSPM runs against this tenant's data. Disabling a pack short-circuits its recognizers (no Lambda cost, no false positives). Changes apply on the next scan after roughly one minute of warm-container caching.
Unscanned resource grace period
How many days a resource can go without a data-classification scan before its unvalidated findings are treated as failures. The evaluator picks the strictest applicable framework's threshold per finding; the "Default" row covers any framework not listed here.
Database Activity Monitoring (DAM)
Stream pgaudit / MariaDB-audit-plugin / Aurora MySQL Advanced Auditing
output through CloudWatch into the SaaS-side Firehose. Events land
in the dam-canonical bucket (Athena-queryable) plus per-minute
rollup rows in database-dam-summary for the rule engine.
Streaming rules (auth + privilege + integrity families) fire alerts
in real time; the Activity view and per-resource Activity tab read
the canonical event stream.
DAM Sources (per-tenant matrix)
Capability matrix for this tenant's DAM ingestion families. CloudTrail management events are per-account; engine audit is per-resource and flipped from each database's Activity tab; CloudTrail data events are per-resource and flipped from each database's Activity tab → Source details. Projected monthly cost per source is derived from the tenant's current event-rate sample assuming the default volume split.
DAM Management Events
Per-account CloudTrail management-event ingestion. One SNS subscription
on the customer's CloudTrail trail captures every database in that
account. Deploy deployment-harnesses/customer/member-account-dam.json
with the trail's SNS topic ARN first, then enable here. For the default
tenant in the SaaS account, use the SaaS account's own trail topic for
testing. Outpost-mode tenants are blocked by design until the
manifest-queue routing PR lands.
DAM Business Hours
Defines the tenant's normal operating window. The
auth.connection_outside_hours scheduled rule fires when
DAM connection / auth events land OUTSIDE this window. Leave
"Configured" set to "off" to disable the rule for this tenant
(no hits emitted regardless of activity). Times are UTC for v2; a
future PR will support per-tenant timezone offsets.
DAM Rule Overrides
Per-tenant overrides for each DAM rule. Disabling a rule drops all its hits;
a severity override re-routes hits (medium+ goes to alerts, low to findings);
suppression patterns (fnmatch globs against actor.username) drop matching hits;
threshold overrides feed per-rule tunables (e.g. failed_login_threshold,
multiplier, min_recent). Backed by SSM at
/database-compliance/<tid>/dam/rule-overrides/<rule_id>.
Auto-Remediation ("Fix it")
One-click execution of a control's config fix from the
Compliance tab. Off by default. When enabled
in preview-only mode, operators can dry-run
the exact API call + diff; switch to apply to
let them execute it. Only controls with a live-validated,
non-disruptive fix are ever one-click; every action runs
through the dedicated DatabaseComplianceRemediatorRole
and is recorded in the durable remediation ledger + audit log.
Estimated monthly cost
Projected AWS cost for this tenant, computed from the live inventory count and a 24-hour DAM-event rate sample. Numbers are estimates; actual AWS billing may vary with usage.
Based on
Estimate your monthly cost
Try different scales and capability combinations to estimate cost. This is a preview only — toggling DAM, DSPM, or Outpost here does not change what's actually enabled on your tenant.
Account discovery
Choose how this tenant finds AWS accounts to inventory. Pick a mode below; Organizations and Hybrid also require the discovery role ARN further down.
Enrolled accounts
Each account you add needs the collector IAM role deployed. Download the setup template and deploy it in the target account before enrolling. The central host account is enrolled explicitly if you want it scanned (assume-role is skipped automatically).
Azure subscriptions
Scan Azure database services through the Delayer Entra service principal your directory admin consents to. Enroll each subscription below; a read-only connectivity probe verifies consent, the Reader role assignment, and the binding tag before the first collection pass.
Add subscription
Guided mints a binding token, renders the admin-consent URL and the exact enrollment script to run against the subscription, then verifies access end-to-end. Manual is for operators who already ran the script out-of-band and just need to record the values here.
The Entra directory that owns the subscription. Prefilled from the card's directory setting when set.
Must match the delayer-binding tag the
enrollment script planted on the subscription — the probe
and every collector pass refuse the subscription on
mismatch. Stored encrypted; never returned by the API
once saved.
The next step mints a fresh binding token and renders the admin-consent URL plus the exact enrollment script for this subscription, then verifies access end-to-end. The token is shown once at generation time and never again — copy it before moving on.
Binding token — record it now, you'll only see it here
…
Generated locally with crypto.getRandomValues (192 bits).
It's already part of the commands below, which plant it on the
subscription as the delayer-binding tag. After this
step the API surfaces only its fingerprint — the value itself
never leaves your browser plus the central store.
1. Grant admin consent, then run the enrollment commands (consent needs a directory Global Admin; the commands need rights to assign Reader + tag the subscription)
Open the consent URL as a Global Admin of the directory — it creates the Delayer service principal in your tenant. Consent is once per directory; if it was already granted for another subscription, go straight to the script.
The commands create the Delayer service principal if needed, assign built-in Reader at subscription scope, and plant the binding tag. Azure Cloud Shell signed into the target directory is the simplest place to run them.
2. Verify
Remove this subscription?
This cannot be undone. Inventory, findings, and scan history
for subscription
will be deleted from this tenant.
Type the subscription id below to confirm.
New classifier
Lowercase a-z 0-9 -. Used in audit log diffs. Not editable after create.
Will be validated client-side as you type.
When a column's name contains a hint, the match-density threshold halves so the classifier fires on lower-density columns.
New framework
Final framework_id = custom:<tenant-hash>:<suffix>.
Not editable after create.
Copy every control from an existing custom framework into the new one. Each control gets a fresh canonical_check_id under the new framework_id.
New control
How much this control matters on an empty database. The severity you see on a finding is computed from this weight and what the database actually holds — a weight-2 control still reads critical on a public database full of card numbers.
Picks the evaluator's built-in check function. Leave as manual for process controls — findings render with status=manual.
When set, the control evaluates as unvalidated /
not_applicable based on DSPM evidence — same gating
built-in HIPAA / PCI-DSS controls use.
Remove this account?
This cannot be undone. Inventory, findings, and scan history
for account
will be deleted from this tenant.
Type the account id below to confirm.
Connector secrets
Where database credentials (used when you provide your own user/password on a database connection) are stored, and which KMS key encrypts them. Two modes:
- Centralized — Credentials stored in this account's Secrets Manager, encrypted with the selected KMS key.
- Account-local — Each enrolled account stores its own credentials, keeping them within that account's security boundary.
Tenant users
Local accounts and group membership for this tenant. Access roles are enforced server-side on every API request.
Tenant groups
Custom Cognito groups for this tenant pool, in addition to the
four built-in roles. Membership is enforced server-side on every
API request. The built-in Admin group cannot be removed.
New group
Letters, numbers, and symbols only — no spaces. Use one word, CamelCase, or hyphens.
Deployment mode
Whether this tenant's scans run on central SaaS Lambdas
(remote, the default) or on customer-deployed
containers (outpost). Activating Outpost mode
requires standing up the heartbeat + connector + dspm
containers and a coordinated super-admin flip — open a
support request to start the process. Reverting to
remote is self-serve and takes effect on the
next dispatcher tick.
Outpost agent health
Status of the customer-deployed Outpost containers that handle scans for this tenant. The Controller agent checks in with the SaaS API every few seconds; Connector, DSPM, and DAM agents receive work through the Controller and appear here once they've reported in.
Revert to Remote SaaS deployment?
This will halt all scanning dispatched to your in-cluster Outpost agents at the next dispatcher tick.
- In-flight scans already claimed by the Outpost containers will run to completion locally; new scans will be dispatched to central SaaS Lambdas via cross-account assume-role.
- Your Outpost containers can keep running. They will simply receive no more work until Outpost mode is re-enabled.
- Re-enabling Outpost mode requires a support request — this switch is one-way self-serve.
Audit log
Append-only history of every state-changing action taken against this tenant — configuration changes, user management, sign-in attempts, scan launches, and alert decisions. Entries are retained for 365 days and cannot be edited or deleted. Visible to Admin and SecurityReader.
Re-encrypt all connector secrets?
This re-encrypts every stored database credential for this tenant using the new mode and KMS key. The migration can take several minutes depending on how many credentials are stored.
Secrets are processed one-by-one. Failures for individual secrets are logged and skipped so the migration completes for everything it can. The operation is not atomic — secrets may briefly exist in both locations during a mode switch.
Add account
Guided generates an external id, shows you the exact CFN command to run in the member account, then verifies connectivity. Manual is for power users who already deployed the member template out-of-band and just need to record the values here.
Recorded at member-account-bootstrap deploy time. Stored encrypted; never returned by the API once saved. To rotate, provide a new value and redeploy the member template.
From the member-account-connector.json stack's
MemberConnectorStateMachineArn output. Must match
the enrolled account id, and the account must have deployed the
template against this exact external id.
From the member-account-dspm.json stack's
MemberDspmStateMachineArn output. Deploy the DSPM
stack only after the connector stack — DSPM imports the VPC
plumbing from member-account-connector.
From the member-account-remediation.json deploy
(RemediatorExternalId parameter). Deliberately a
separate secret from the collector/DAM external id —
remediation has no fallback to the shared id and stays
independently rotatable. Leave blank to keep the stored value.
The next step generates a fresh ExternalId and the exact CFN command to run in the member account, then verifies the cross-account assume works end-to-end. The ExternalId is shown once at generation time and never again — copy it before moving on.
ExternalId — copy now, you'll only see it here
…
Generated locally with crypto.getRandomValues (192 bits).
It's already part of the command below. After this step the API
surfaces only its fingerprint — the value itself never leaves your
browser plus the central SSM parameter.
1. Run this in the member account (needs IAM:CreateRole on the target)
The template
(deployment-harnesses/customer/member-account-inventory.json)
must be on local disk where the command runs. CloudShell in
the target account is the simplest path — paste the template
via cat > member-account-inventory.json, then
run the command above.
2. Verify connectivity
New User
Internal identifier. Used for API integrations and support tickets.
New Report
Evidence packages are signed `.tar.gz` bundles auditors verify offline. See the bundle's README.txt for the openssl verification command.
Pick at least one framework.
Use the Frameworks filter above to narrow this list.
Leave empty to include all values for this dimension.