Environments

Environments in ACE represent a distinct operational context or workspace, allowing users to apply scans that only apply to this space. They are also tied to RMF Boundaries, ensuring that the security and compliance requirements specific to each environment are properly managed and enforced. Each environment can have its own set of assets, and vulnerabilities and compliance checks on those assets.

Creation

To create a new environment in ACE, follow these steps:

1. Navigate to the Environments section from the main menu.
2. Click on the Create Environment button.
3. Fill in the required details, such as the environment name, description, and associated RMF Boundary.
4. Configure any additional settings as needed.
5. Click Create to create the environment.

Details

Once an environment is created, you can view and manage its details by selecting it from the Environments list. The details page includes statistics such as the number of assets, scans uploaded, users assigned, who created the environment, and more.

Users

In the Users tab of an environment, you can view the list of users assigned to the environment. If you have admin privileges, you can manage users by clicking Modify Users, which allows you to add or remove users and assign roles within the environment. Assigned users can view information within the environment and upload scans.

Scans

In the Scans tab of an environment, you can view the list of scans uploaded to the environment. This includes information on the scan name, date uploaded, time the raw scan file will still be available to download, and the number of assets/vulnerabilities the scan created, updated, or failed to create. Clicking on the ID of an entry will navigate to the Scan details page. If you wish to upload a scan to the environment, navigate to the Scans page, select the environment, and follow the instructions for uploading a new scan.

For more information on Scans, refer to the Scan Ingestion documentation.

Assets

In the Assets tab of an environment, you can view assets associated with the environment. This will tell you their Lifecycle status, type, vulnerabilities and mitigations assigned, and the scan tools from which they are derived.

For more information on Assets, refer to the Assets documentation.

Snapshots

In the Snapshots tab of an environment, you can view snapshots of the environment, which capture the number of assets, vulnerabilities of each category, and number of remediations at a specific point in time. This allows you to track the security posture of the environment over time.

Sources/Bucket Ingestion

In the Sources tab of an environment, you can view and configure automatic scan ingestion from an S3 Bucket. An admin must have already created a Bucket Ingestion Configuration (BIC) in the System Settings. Once the BIC is created, the admin can link it to the environment by selecting Assign Bucket Configuration.

After assigning the bucket configuration, the environment will automatically ingest scan results from the specified S3 bucket according to the settings defined in the BIC. Users can enable and disable ingestion for the specific environment, see reports of past ingestion passes, and trigger a manual scan of the S3 bucket for scans.

For more information on Sources/Bucket Ingestion, refer to the Automated Scan Ingestion documentation.

Note: Only Admins can create Bucket Ingestion Configurations (BICs).

Deletion

Only admins can delete an environment. Open the environment, select Delete environment, review what the deletion removes, and type the environment's name to confirm.

An environment cannot be deleted while:

• It has child environments. Delete them, or move them to another parent, first.
• Any of its scans are queued or running. Wait for them to finish.

Deleting an environment removes:

• Assets that belong only to this environment, with their vulnerabilities and compliance checks.
• Vulnerabilities and compliance checks on shared assets that only this environment's scans reported.
• Its scans. The uploaded scan files are removed by the next upload cleanup.
• Its user memberships, snapshots, scan tools, root asset links, RMF Boundary links, bucket ingestion settings and runs, security events, and environment lifecycle policies.

Deleting an environment keeps:

• Assets shared with another environment, including assets that are a root asset of another environment. They are only unlinked from this one.
• RMF Boundary members. Removing the environment from a boundary does not change who belongs to the boundary.
• The audit log.

The deletion runs in the background, and new scans for the environment are rejected until it finishes. You can close the dialog and reopen it to see the progress. If some records cannot be deleted, the environment is kept and the dialog shows what failed; select Retry deletion to try again. A deletion cannot be undone.