Security Posture, Incidents & Anomaly Rules
A posture score with a 30-day trend, incidents worked from open to a recorded closing reason, anomaly rules that watch sign-ins, refusals, exports and deletions every 15 minutes, device rules per role, and an audit trail whose retention can only be lengthened.
All of this sits in the Security Control Center and under Settings → Security. The score and incidents are also in the AWRA mobile app.
Posture Score
A score from 0 to 100, recalculated every morning, with the last 30 days drawn as a trend. It is weighted towards what most often goes wrong:
| Part | Weight |
|---|---|
| Multi-factor authentication coverage | 25 |
| Open security incidents | 20 |
| Security policy settings | 20 |
| Failed sign-in trend | 15 |
| Device trust | 10 |
| Access hygiene | 10 |
Working An Incident
- An incident opens from an anomaly rule, an audit-chain check or by hand. Its status moves through Open, Triaged, Resolved or Ignored.
- Assign it to a person, add comments, and record remediation notes as you act.
- Close it with a reason: Remediated, False positive, Accepted risk, Duplicate or Expected activity. A closure without a reason is refused.
- Export the incident’s full timeline as CSV for a report or an insurer.
Working incidents needs the manage security incidents permission. The same actions are in the API.
Anomaly Rules
These run every 15 minutes and are on by default. Each finding opens an incident. Change any threshold under Settings → Security → Anomaly rules; setting one to zero switches that rule off.
- Impossible travel — the same person signing in from two countries within two hours. This reads the visitor’s country from the network edge, so it works only where that information is supplied.
- Failed sign-ins — 10 for one account, or 25 from one IP address, within an hour.
- Repeated refusals — 20 refused requests for one person in an hour, a sign of someone probing what they cannot open.
- Export spikes — 20 or more exports in an hour and three times the person’s own hourly average over the last seven days, so a finance team’s normal month-end is not flagged.
- Mass deletions — deleting across three or more modules within an hour.
Device Rules By Role
Under Settings → Security, each role can require an approved device, block device classes (rooted or jailbroken phones, emulators, unknown platforms, or the web browser so the role works from the app only), and limit how many hours a device stays trusted offline. Someone with several roles gets the strictest rule. The rules apply at web sign-in and in the mobile app. See Device Trust.
Audit Retention Lock
Lock how long audit records are kept, between one and ten years. A lock can be lengthened at any time but never shortened. Lifting it takes a request, a seven-day wait, and confirmation by a different Admin, so no single person can quietly shorten your audit history.
Nightly Audit-Chain Check
Audit entries are hash-chained. Every night the chain is verified. If a link is broken, an incident opens in your workspace and AWRA’s platform team is emailed once for that break, so tampering or damage is investigated rather than discovered by chance. See Audit Logs.
Evidence Mapped To Control Frameworks
Every evidence pack now includes a control map that lines each section up with the clauses an assessor will ask about, for example ISO 27001 Annex A, the SOC 2 criteria and the Kenya Data Protection Act. It also lists any section that is missing. The map helps your assessor find evidence; it is not a certification, and AWRA does not claim to hold one.
Need help with this topic?
Capture the module, record number, branch or warehouse, user, visible message, and what you expected to happen before contacting support.