Threat Center

The account-wide security view - every host's vulnerabilities and exposures, indicators of compromise and runtime detections ranked together, with search and CSV export.

The Threat Center in the sidebar shows the security findings of every host in your account in one ranked list, instead of one server at a time. Use it to answer "where should I start today?" across a fleet, then open the host that needs work.

The per-host view is the Threat Center tab on a host. That page explains what each finding type means, what its scores say about how urgent it is, and how to decide what to fix first. This page only covers what is different about the account-wide view.

The account-wide Threat Center with the search box, the severity chips and the findings list
The account-wide Threat Center with the search box, the severity chips and the findings list

What it covers

The list includes every active host you have access to in the current account, including the members of a cluster. A finding on a cluster member names the cluster and the member (cluster · member). Its link opens the cluster's own Threat Center tab, where you act on it.

The three panels are the same as on a host: Vulnerabilities & Exposures, Indicators of Compromise (IoC) and Runtime Detections. Each panel says so plainly when it is empty, for example "No known vulnerabilities on your hosts."

Findings are ranked by risk across the whole account, so the most urgent finding on any host is at the top. The list is a ranked top of 200 findings per panel, shown 30 per page. It gives you the findings that matter most, not a complete inventory. Open a host's own Threat Center tab to work through everything on that server.

The Vulnerabilities & Exposures panel has a chip per severity band (Critical, High, Medium, Low, Info) with the number of findings in that band. Only bands with findings are shown. Select a chip to narrow that panel to the band, and All to clear it.

Reading the rows

  • Each finding names the host it was found on, next to the package and the file path. The host name is a link to that host's Threat Center tab.

  • A finding with the Exposure badge is reported as an exposure rather than a known software vulnerability. It sits in the same list and follows the same ranking.

  • In the IoC panel, confirmed malware shows a red banner ("Confirmed malware detected - immediate action required."). Suspicious evidence that still needs review shows an amber Evidence badge and an amber banner. See Indicators of compromise for what to do.

  • An IoC that was acknowledged on its host is not listed here.

Finding what you need

  • Search - one box over the host name, the Common Vulnerabilities and Exposures (CVE) identifier, the package and the rule name. Use it to answer "is this vulnerability anywhere in my account?" or "which servers still run this package?". The search is part of the page address, so you can bookmark it or send it to a colleague.

  • Severity chips - narrow the Vulnerabilities & Exposures panel to one band.

What you can do here

  • Export on a panel downloads its current list as a CSV file, with a Host column first. The export follows the active search and severity chip.

The account-wide page is read-only. Rescan, Dismiss and Clear all act on one server, so you do them on the host's Threat Center tab. For a cluster, the cluster's Threat Center tab offers Rescan all nodes, Rescan node per member, and the same dismiss and clear actions.

If a fetch fails, the page shows a banner instead of an empty list. When security scanning is not set up for the account, it says "Security scanning is not configured for this dashboard." In both cases, contact support if it persists.

© 2026 Hosted Power — TurboStack