HEIMDAL Dashboard overview

In this article, you will see and understand how the HEIMDAL Dashboard works, the data collected from your environment, and what are the benefits of the HEIMDAL Unified Threat Platform. The HEIMDAL Dashboard allows you to see what are the threats that are intercepted in your environment, thus enabling you to mitigate and take action against malware. The HEIMDAL Dashboard works with a variety of Internet browsers, but it is best supported by the following: Google Chrome (recommended), Mozilla Firefox, Microsoft Edge, and Safari.

1. Home
2. Admin
3. Unified Management
4. Customer Overview
5. Products
6. Threat-hunting & Action Center
7. Accounts
8. Guide
9. Reports
10. Support

HOME

Right after you log in to the HEIMDAL Dashboard, you are presented with the HEIMDAL Dashboard Home page and the Group Policies overview that warns the HEIMDAL Dashboard user that one or more HEIMDAL products are not enabled in the Group Policy settings. It also supports a freeze panes behavior on the first column. This ensures that the Group Policy column remains visible during horizontal scrolling, allowing for easier navigation, better context retention and more efficient analysis across extended views.

Pressing the Acknowledge button will close the Group Policy overview. This modal will pop up for every user who logs in to the HEIMDAL Dashboard for the first time, or for every impersonated enterprise customer (when a user with the reseller role is logged in). The Group Policy overview modal will reappear once any other HEIMDAL Dashboard user assigned to the same customer enables/disables a HEIMDAL product in any Group Policy, or when it enables/disables reporting mode in any Group Policy, or when a new Group Policy is created, or an existing one is deleted.
The left-side menu allows you to navigate to any section of the HEIMDAL Dashboard. On the top, you can use the Customer impersonation field (available to Resellers only) that allows you to impersonate the Enterprise account of any of your customers. The Timeframe selection field allows you to select the Start-Date and the End-Date to display the information collected in the HEIMDAL Dashboard. The Endpoint Settings and the Network Settings allow you to configure the settings for the HEIMDAL Security products.

On the right side of the Home page, you get information about each of the products/modules that are active under the current customer account. The charts include data regarding attacks, vulnerabilities, detections, infected/quarantined files, blocked/allowed processes, 3rd-party application vulnerabilities or OS Updates, and quarantined/rejected emails. Is it important to know that the information displayed in the charts considers the selected Timeframe and, by default, the Timeframe stretches 30 days in the past. The chart order can be switched using drag and drop, and the inactive products will be listed at the end of the homepage (by default). The order of the products is saved at the user account level. This means that another user account of the same customer will see a different order (according to the user's settings). You can also click the graph area/segment to get redirected to the relevant product page.

Clicking the eye icon (top-right corner) will redirect you to the product page. Some products allow you to take action straight from the chart itself (e.g., Next-Gen Antivirus & MDM, Ransomware Encryption Protection, Privilege Elevation and Delegation Management, Email Security). 

Hovering over the graphics in the chart will offer you information for that specific date.
On the bottom side of the Home page, you can see the contact information of HEIMDAL Security and the HEIMDAL Dashboard version:

Distributors and Resellers will see a new homepage with the license overview representing a centralized overview per product of all the licenses that are under their management. This view showcases the number of licenses, as well as the available ones. Total seats represent the number of purchased* or committed* licenses for a product/module. Used is the number of user licenses for each product. Available is the difference between the Total seats and Used. This page will also allow the Partner to filter the data from the grid, offering the possibility to see All, Monthly Billing, and/or Annual licensing types. On the bottom section of the new homepage, the Distributor/Reseller will find links to our Support Knowledge Base articles and the Heimdal™ YouTube channel, which holds lots of interesting and useful video training content.

 

ADMIN

The Admin page (available for the Reseller accounts) allows you to add new customers or edit existing ones and manage their licensing options. You can add/delete Home Batch Keys (if they are activated on your reseller account). The Customers menu displays a list of all your customers and details such as ID, Name, Type, License Type, SPLA License, Device, Churn score, and Purchased Licenses. In this section, you can add a new customer, and you can also generate a CSV report that includes the list of all customers (the CSV report will be populated with all the customers that have activity/have active clients):

• Creating a new customer is easy and can be done by filling in the required fields.
  
  Name - specify the name of the new customer.
  Type - Corp available only.
  Total licenses - specify the number of devices.
  Email - specify the email address of the customer account owner.
  Details - specify any details that you considered necessary to be saved.
• The Licensing options section is where you select which products/modules are available for the customer. 
  
• The Licensing management allows you to create a new license for an existing customer by pressing the Add License button. Or it allows you to manage your existing licenses by pressing the license number
  
  
• The Billing Info section is not mandatory, but you can fill in the requested information:
  

Under Batch Licenses, you can create new Home Batch Keys, you can view the Registered Batch Keys and the Non-Registered Batch Keys, and you can delete the generated licensed keys. 

This view also allows you to download a list of all Home licenses included in a Batch.

The Usage Reporting provides partners with a consolidated view of customer licensing, device metrics, and billing data across their entire ecosystem. These reports are designed to streamline auditing, tracking, and monthly billing reconciliation.

You can generate two types of reports:

• Device Info Report
  This report provides a detailed breakdown of device counts and licensing statuses across your customer base. When generating a Device Info Report, you must choose one of three filtering options to narrow down the data:
  All Customers: Includes every single customer under your partner account, regardless of their assigned licensing type.
  Monthly Billing Customers Only: Filters the report to include only the customers currently on a Monthly Billing licensing model.
  Non-Monthly Billing Customers Only: Filters the report to include only customers who are not on a Monthly Billing licensing model (e.g., annual, perpetual, or trial licenses).
• Monthly Billing Info Report
  This report is specifically tailored for financial and account reconciliation. It aggregates and extracts billing-specific metrics for your active accounts over the designated 30-day period, making it easy to plug directly into your internal invoicing or accounting workflows.

UNIFIED MANAGEMENT 

ROI REPORT

The Return on Investment (ROI) reports are considered essential analytics tools and are useful because they review the costs saved by your organization by using the HEIMDAL Security suite. On this page, you can see charts about the DNS Security, Patch & Assets Management, Endpoint Detection, Privileges & App Control, Remote Desktop, Email Protection, and Threat hunting & Action Center. On top, you have a summary of the ROI Report:

Below the summary, you get a chart for each product detailing the saved costs per category:

• Revoke - revokes the HEIMDAL license key from the selected endpoint, making the HEIMDAL Agent downgrade to the Free version (only the 3rd Party Software module is available). The HEIMDAL Agent will stop communicating with the HEIMDAL Dashboard, and it will stop applying any other settings specified in the Group Policy. The revoked device(s)/endpoint(s) can be unrevoked from the Revoked view by selecting them and hitting Unrevoke in the dropdown menu.
   
• Add to group - adds the endpoint(s) to a selected Hostname Group (available in the Hostname groups view).
• Isolate - isolates the selected device(s)/endpoint(s) by blocking the external connection. Note: if your Firewall settings are managed through another application/vendor or Intune, the HEIMDAL Agent will not be able to achieve the isolation operation. In case you are using Microsoft Intune to manage the Firewall settings, you need to disable any policy that interacts with it. An example would be the one below, in which the Firewall settings should be set to Not configured (Endpoint security -> Security Baselines baselines -> Security Baseline for Windows 10 and later -> Intune Security Baseline Policy -> Properties, edit the Configuration settings, and set the Firewall settings to Not configured)/
  
• Unblock RDP Port - unblocks the default RDP Port (3389) if it has been blocked due to a Brute Force Attack detection. The Unblock RDP Port option will not appear if the RDP port is not blocked.
  Applying the Unblock RDP Port option will show the following notification:
  
• Cancel Unblock RDP Port - cancels the Unblock RDP Port action.
• Scan non-Heimdal devices - tells the selected computer to perform a network scan for computers that are not running the HEIMDAL Agent (this option is available if Allow network scan is enabled in the Group Policy settings and discovers endpoints/devices ONLY if they are registered in the Reverse Lookup Zone of the DNS Server). This operation initiated the scan for non-Heimdal devices in less than 2 minutes (if Realtime Communication is enabled) or immediately after pressing the Sync GP button (within the HEIMDAL Agent). The HEIMDAL Agent will be using the local IP Address and the local Subnet Mask to calculate the IP class for the current Subnet. An nslookup is performed for each discovered IP Address to correlate the Hostname with the IP Address, a ping is used to populate the ARP cache for each IP Address, and an arp -a command is performed to get the MAC address for each IP address.
• Install 3rd Party Software - installs one or more 3rd-party application(s) from the list of 3rd Party Patch Management applications.
• Uninstall 3rd Party Software - uninstall one or multiple applications that support uninstall through the HEIMDAL Agent.
• Apply script - allows you to run an on-demand script defined in the Scripting section.
• Next-Gen Antivirus scan - perform a Next-Gen Antivirus scan from the scan type list.
• Apply to Specific GP - allows you to apply a specific Group Policy to the select device(s)/endpoint(s) or to set it/them to Automatic to apply a Group Policy automatically, based on GP Priority, Azure AD Group, AD Computer/User Group, ComputerTag/UserTag, External IP Address.
• Clear AAD cache and resync - sends a server command in real-time to the Heimdal Agent to clear the AAD cache and perform a sync of the AAD Groups. This server command is available only if Azure AD sync is configured (in the Customer Settings -> Login Setup -> Azure login area). You can cancel the server command if the resolution is Pending or In Progress.
• Install DNS-N LogAgent and HybridDNS - This option enables the installation of the DNS Security Network LogAgent and HybridDNS on a Windows Server endpoint, allowing network filtering by associating IP addresses of allowed requests and prevented attacks to hostnames, and ensuring automatic updates whenever a new version is available.
• Add OS Deployment Server - allows administrators to designate a specific device within their network as a PXE (Preboot Execution Environment) deployment server. This server is responsible for distributing Windows operating system images to client endpoints over the network, streamlining the OS installation process. Key features: Automates and centralizes OS deployment across multiple endpoints. Enhances security and control by limiting PXE broadcasts to selected network segments. Simplifies management of OS images and deployment settings.
• Wake - An action available in the Heimdal Dashboard (under Unified Endpoint Management - Device Info) that leverages the Wake on LAN (WoL) networking protocol to remotely turn on a selected device from a lower-power state (such as sleep or hibernate) by sending a unique signal over the local network, known as a "magic packet." This allows administrators to maintain access to devices and their files/apps while minimizing power consumption, since machines can be put to sleep when idle and woken remotely when.
• Schedule one-time reboot - allows you to schedule a one-time reboot that the HEIMDAL Agent will trigger. The reboot can be configured according to a schedule, and the HEIMDAL Agent can display a reboot pop-up to inform the user that a reboot is going to take place.
  
  If configured, the reboot can be postponed. If no reboot pop-up is configured, the end user will only get a 5-minute warning telling them that the operating system will reboot in 5 minutes. This action will be reflected in the Server commands tab, where the HEIMDAL Dashboard admin can see the status of the server command. It's part of best practice to schedule a one-time reboot at least 3 hours from the configuration moment, to make sure the action is propagated to the HEIMDAL Agent from the HEIMDAL Dashboard.

Clicking on a hostname will direct you to another page where you can see information regarding the HEIMDAL Agent status, the Device information, the Hardware information, the Operating System information, the Antivirus information, the DNS information, and the Enabled Modules.

Clicking on the number of Modules will display a list of all the modules that are enabled on the selected device(s)/endpoint(s). 
Clicking on the Status exclamation icon will pop up a modal that will show you the current status of the HEIMDAL Agent and the steps required to get the device/endpoint operational. 

DEVICES/USERS COMPLIANCE

This page covers devices and users' information in regard to the Cyber Essentials recommendations. When navigating to it, the HEIMDAL Dashboard user can refer to a Devices view and to a User’s view.  

• Cyber Essentials devices view

  This level of visibility helps you quickly identify potential vulnerabilities, ensure consistent protection across all devices, and maintain Cyber Essentials readiness. For an endpoint to be considered compliant, all key security controls — Next-Gen Antivirus (NGAV), Firewall, Patching, and Admin Rights — must be properly enabled. 
  The view displays the current state of each control (enabled/ disabled) for every device, allowing administrators to quickly identify and address non-compliant systems. From this view, you can also see which Group Policy is assigned to each endpoint, helping you verify configuration sources and manage compliance more effectively. Devices running macOS or Linux will have several areas marked as N/A (Not Applicable), as these operating systems do not support the same range of modules and integrations available for Windows-based devices. This behaviour is expected and aligns with the platform’s current compatibility scope for Cyber Essentials compliance monitoring.
  The view, like the majority of the Heimdal dashboard ones, provides search, filtering, sorting, and download .csv options.

• Cyber Essentials users view

  The Users view provides an overview of user-level Cyber Essentials norms adherence. It displays the status of key security controls — Multi-Factor Authentication (MFA), Strong Passwords, and Password Expiration — indicating whether each control is enabled (true) or not (false). Administrators can quickly identify users who are non-compliant and take appropriate actions to strengthen account security and maintain overall Cyber Essentials readiness. The Users view in Cyber Compliance highlights accounts that are not compliant (the source of the info being the Threat – hunting & Action Center -> M365 Action Center -> User Compliance view), meaning they have at least one required security option disabled.
  

  The search, filtering, sorting, and download .csv options are similar to the ones from the Device view.

  IMPORTANT

  User data visualisation is subject to the M365 User Security module being licensed and to the individual settings related to Multi-Factor Authentication and Password compliance being enabled in Network Settings. 

CLIENT MANAGEMENT

The Client Management section is divided between BitLocker, Scripting, and USB Management, and you can learn everything about it here.

REVENUE SHARE

The Revenue share page displays the information referring to the revenue share of the customers. On the top, you see a statistic regarding the Number of licenses attached to your account, the Projected revenue share next year, the Projected revenue share the year after, and the Revenue share.

The collected information refers to Client Name, Email Address, Renewal Date, Revenue Share, and Total Revenue.

CUSTOMER OVERVIEW

Distributors and Resellers can visualize an overview of each Reseller or Enterprise customer and their current licensing status directly from the Customer Overview page. The page provides a centralized, single-pane view of customer environments with their used licenses and the total number of purchased licenses (per product/service), helping partners manage licensing visibility and customer administration more efficiently across larger portfolios. The Customer Overview page includes functionality designed to simplify customer identification, navigation, and management workflows for Distributor and Reseller accounts. Users can quickly search for and identify either corporate customers or reseller accounts directly from the overview page, depending on the role and access level of the logged-in dashboard account. The page also includes performance and stability optimizations intended to improve responsiveness when handling larger customer portfolios. Backend data retrieval processes and queries are optimized to provide faster load times and a more reliable overall experience. 

• Create Group - allows you to create a group to assign customers to, helping you organize and filter Reseller or Enterprise customers more efficiently when managing multiple accounts or customer segments.
• Create New Customer - redirects you to the Admin section of the HEIMDAL Dashboard and allows you to create a new Reseller or Enterprise customer.
• Filters - opens a toaster panel that allows filtering by Customer Groups, Client Info Type, or Billing Type.
• Search by End User - allows Distributor and Reseller accounts to quickly identify and access specific corporate customers or reseller accounts directly from the Customer Overview page.

IMPORTANT

The data in this grid is gathered by a job that runs every Sunday (once a week) and considers the last 30 days (it does not consider the timeframe). 

PRODUCTS

DNS Security - Network (Windows and Ubuntu)
To see the DNS Security - Network (Windows and Ubuntu) product description, click here.

DNS Security - Endpoint (Windows)
To see the DNS Security - Endpoint (Windows) product description, click here.

DNS Security - Endpoint (macOS)
To see the DNS Security - Endpoint (macOS) product description, click here

VectorN Detection (Windows and macOS)
To see the VectorN Detection (Windows and macOS) product description, click here.

3rd Party Patch Management (Windows)
To see the 3rd Party Patch Management (Windows) product description, click here.

3rd Party Patch Management (macOS)
To see the 3rd Party Patch Management (macOS) product description, click here.

3rd Party Patch Management (Linux)
To see the 3rd Party Patch Management (Linux) product description, click here.

Infinity Management (Windows)
To see the Infinity Management (Windows) product description, click here.

Infinity Management (Linux)
To see the Infinity Management (Linux) product description, click here.

Operating System Updates (Windows)
To see the Operating System Updates (Windows) product description, click here.

Operating System Updates (macOS)
To see the Operating System Updates (macOS) product description, click here.

Operating System Updates (Linux)
To see the Operating System Updates (Linux) product description, click here.

Next-Gen Antivirus (Windows)
To see the Next-Gen Antivirus (Windows) product description, click here.

Next-Gen Antivirus (macOS)
To see the Next-Gen Antivirus (macOS) product description, click here.

Extended-Threat-Protection (XTP)
To see the Extended-Threat-Protection (XTP) product description, click here.

Firewall (Windows)
To see the Firewall (Windows) product description, click here.

Ransomware Encryption Protection (Windows)
To see the Ransomware Encryption Protection (Windows) product description, click here.

Ransomware Encryption Protection (macOS)
To see the Ransomware Encryption Protection (macOS) product description, click here.

Privileged Elevation and Delegation Management (Windows)
To see the Privileged Elevation and Delegation Management (Windows) product description, click here.

Privileged Elevation and Delegation Management (macOS)
To see the Privileged Elevation and Delegation Management (macOS) product description, click here.

Privileged Account & Session Management (PASM)
To see the Privileged Account & Session Management (PASM) product description, click here.

Application Control (Windows)
To see the Application Control (Windows) product description, click here.

Email Security
To see the Email Security product description, click here.

Email Fraud Prevention
To see the Email Fraud Prevention product description, click here.

Remote Desktop
To see the Remote Desktop product description, click here.

THREAT-HUNTING & ACTION CENTER

Threat - hunting and Action Center (TAC) collects data referring to events inside your organization by leveraging our Extended Threat Protection (XTP) Engine, the renowned MITRE ATT&CK techniques center, and the rest of the Heimdal products to provide granular telemetry into IT environments, endpoints, networks, and beyond to help teams proactively classify security risks, hunt detected anomalies, and neutralize persistent threats securely without risking the spread of attacks, disrupting end-users, or affecting organizational productivity.
You can read more about it HERE.

ACCOUNTS

The Accounts page is the area in which you can create new enterprise/reseller accounts and assign them to a specific Enterprise/Reseller customer or edit existing ones and manage their configuration. 
 

A. Enterprise/Corp customers

Enterprise customers can create/edit Enterprise accounts that can get the Administrator role (can view/add/edit HEIMDAL Dashboard settings) or the Visitor role (can view the HEIMDAL Dashboard information but cannot add/edit any settings). 
In the Accounts tab, you can see a list of all HEIMDAL Dashboard user accounts under your Enterprise customer. At the same time, you can use the Create New Account button to create a new HEIMDAL Dashboard user account (see https://support.heimdalsecurity.com/hc/en-us/articles/360020061117-Creating-a-new-HEIMDAL-Dashboard-account). 
In the Custom Role Management tab, you to create/edit/delete a custom role that can be assigned to a HEIMDAL Dashboard user account or multiple user accounts. A Custom Role can be assigned to users who log into the HEIMDAL Dashboard using the SAML 2.0 mechanism based on the synced Azure Active Directory group (the Azure AD Groups must be synced in the Guide -> Customer settings area first to become visible in the dropdown menu where you sync an Azure AD Group to a Custom Role). 


The newly-created Custom Role can be assigned to one or more accounts by editing the user accounts settings in the Miscellaneous Settings. The Custom Role functionality is available to Reseller and Enterprise customer user accounts only. A Custom Role applying to a user account supersedes the individual Access Control settings of the user account. This means that disabling the Manage account claims on the Custom Role applying to a user will automatically supersede the user account's claims and disable the individual Manage account claims that were configured on the user account's Access Control.
Access Control claims can be configured for any HEIMDAL Dashboard user account by clicking on the user account and going to the Access Control tab.

Manage Custom Roles - Ability to view and/ or edit (create and delete) custom roles in your organization.

- View Custom Role Management area
- Full control Custom Role Management area

Manage account - Ability to view and/ or edit (create and delete) the allowed dashboard account logins.
- View account
- Create account
- Edit account
- Delete account

Account does not require 2-Factor - Ability to tick "Do not require 2-Factor' in the account section for the accounts visible to the user.

Manage API key - Ability to view and/ or edit (create and delete) and view the API key and data.
- View API key
- Edit API key

Manage Endpoint Settings area - Ability to view and/ or edit the Endpoint Settings area.
- View Endpoint Settings area
- View DarkLayer Guard™ endpoint settings
- View VectorN Detection™ endpoint settings
- View 3ʳᵈ Party Patch Management endpoint settings
- View Operating System Updates endpoint settings
- View Next-Gen Antivirus endpoint settings
- View Firewall endpoint settings
- View Ransomware Encryption Protection endpoint settings
- View Privileged Access Management endpoint settings
- View Application Control endpoint settings
- View Zero Trust endpoint settings
- View Email Fraud Prevention endpoint settings
- View Remote Desktop endpoint settings
- View Extended Threat Protection Endpoint settings
- View BitLocker Endpoint settings
- View Scripting Endpoint settings
- Edit Endpoint Settings area
- Edit DarkLayer Guard™ endpoint settings
- Edit VectorN Detection™ endpoint settings
- Edit 3ʳᵈ Party Patch Management endpoint settings
- Edit Operating System Updates endpoint settings
- Edit Next-Gen Antivirus endpoint settings
- Edit Firewall endpoint settings
- Edit Ransomware Encryption Protection endpoint settings
- Edit Privileged Access Management endpoint settings
- Edit Application Control endpoint settings
- Edit Zero Trust endpoint settings
- Edit Email Fraud Prevention endpoint settings
- Edit Remote Desktop endpoint settings
- Edit Extended Threat Protection Endpoint settings
- Edit BitLocker Endpoint settings
- Edit Scripting Endpoint settings

Manage Windows Endpoint Settings area - Ability to select access rights on the Windows Endpoint Settings area.
- Full access to device settings windows
- Specific access device settings windows

Manage macOS Endpoint Settings area - Ability to select access rights on Mac OS Endpoint Settings area.
- Full access to device settings on macOS
- Specific access device settings macOS

Manage Linux Endpoint Settings area - Ability to select access rights on the Linux Endpoint Settings area.
- Full access to device settings Linux
- Specific access device settings Linux

Manage DNS Security Network Settings area - Ability to view and/ or edit the DNS Security Network data/Settings area.
- View DNS Security network data
- View DNS Security network settings
- Edit DNS Security network settings

Manage Email Protection Network Settings area - Ability to view and/ or edit the Email Security Network Settings area.
- View email security network settings
- Full control of email security network settings

Manage Email Protection data - Ability to manage Email Security settings at specific or all domain levels (view, release, blacklist, whitelist) + view data related to body and attachments.
- View email security data
- View email security sensitive
- Release email security
- Whitelist blacklist email security
- Full access email security domain
- Specific access email security domain

Manage Ransomware Encryption Protection Network Settings area - Ability to view and/ or edit the Ransomware Encryption Protection Network Settings area.
- View Encryption Network data
- View Encryption Network settings
- Edit Encryption Network settings

Manage Network OS Deployment Network Settings area - Ability to view and/ or edit the Network OS Deployment Network Settings area.
- View network os deployment settings
- Edit network os deployment settings

Manage Login Anomaly Detection Network Settings area - Ability to view and/ or edit the Login Anomaly Detection Network Settings area.
- View login anomaly detection settings
- Edit login anomaly detection settings

Manage customer data on all product/ module grids - Ability to view data and/ or perform actions on all the Heimdal products/ modules' grids (e.g., quarantined files, excluded files, Group Policy settings, Isolated machines, Approved/ Denied PAM escalation requests, etc.).
- View products data
- View DNS Security Endpoint data
- View VectorN Detection™ data
- View 3ʳᵈ Party Patch Management data
- View Infinity Management data
- View Operating System Updates data
- View Next-Gen Antivirus data
 - View Firewall data
- View Ransomware Encryption Protection data
- View Privileged Access Management data
- View Application Control data
- View Zero Trust data
- View Forensics data
- View Email Fraud Prevention data
- View Remote Desktop data
- Perform actions on product data
- Perform actions on DNS Security Endpoint data
- Perform actions on VectorN Detection™ data
- Perform actions on 3ʳᵈ Party Patch Management data
- Perform actions on Infinity Management data
- Perform actions on Operating System Updates data
- Perform actions on Next-Gen Antivirus data
- Perform actions on Firewall data
- Perform actions on Ransomware Encryption Protection data
- Perform actions on Privileged Access Management data
- Perform actions on Application Control data
- Perform actions on Zero Trust data
- Perform actions on Forensics data
- Perform actions on Email Fraud Prevention data
- Perform actions on Remote Desktop data

Manage PEDM elevations for Windows endpoints
- Full access PEDM elevations Windows
- Specific access PEDM elevations Windows
Manage PEDM elevations of macOS endpoints
- Full access PEDM elevations Windows
- Specific access PEDM elevations Windows

Manage Device Info area - Ability to edit the Device Info area.
- Edit Device Info area
- View Device Info Custom columns
- Edit Device Info Custom columns
- View Hostname groups
- Edit Hostname groups

View BitLocker Recovery Keys

- View the BitLocker Recovery Keys

Generate email reports - Ability to generate Email Security reports.
- Generate email reports

Manage customer settings - Ability to manage settings in the GUIDE section of the Heimdal Dashboard, Customer Settings tab.
- Manage customer settings

View customer license - Ability to view the license key in the Guide section of the Heimdal Dashboard.
- View customer license

View uninstall password - Ability to view the Master Password for uninstalling the Heimdal Agent.
- View uninstall password

Invite to remote session - Ability to invite other users to a remote session
- Remote desktop invite to session

Remote Desktop connection - Ability to connect to any endpoint regardless of GP access rights
- Remote desktop connect full access

B. Resellers

Resellers can create/edit user accounts that can get the Administrator role (can view/add/edit HEIMDAL Dashboard settings) or the Visitor role (can view the HEIMDAL Dashboard information but cannot add/edit any settings). These accounts can be assigned to Enterprise customers only. Resellers can also create/edit user accounts with the Reseller role (can view/add/edit HEIMDAL Dashboard settings at the reseller-level and at the enterprise customer level).
In the Accounts tab, you can see a list of all HEIMDAL Dashboard user accounts under your Reseller (including the users' accounts assigned to each Enterprise customer). At the same time, you can use the Create New Account button to create a new HEIMDAL Dashboard user account (see https://support.heimdalsecurity.com/hc/en-us/articles/360020061117-Creating-a-new-HEIMDAL-Dashboard-account). 
Custom Role Management is tied to each Enterprise custome,r and this means that if you want to add a custom role, you need to impersonate the customer that you are trying to update. In the Custom Role Management tab, you can create/edit/delete a custom role that can be assigned to a HEIMDAL Dashboard user account or multiple user accounts. Resellers can set up or edit Access Control settings for Enterprise accounts of any of their Enterprise customers or for the other reseller accounts. 
Access Control claims can be configured for any HEIMDAL Dashboard user account by clicking on the user account and going to the Access Control tab.

C. Distributors
Distributors can create/edit Distributor accounts that can get the Distributor role (can view/create/edit Reseller customers), but they cannot perform any changes on the HEIMDAL products. Also, distributors can create/edit Reseller accounts that can be assigned to any Reseller customer under the Distributor account.

GUIDE

The Guide page is the area where you get information about the HEIMDAL license key, the API Key, the latest versions of the HEIMDAL installers, your Customer settings (restriction of the data for the HEIMDAL Security employees, SAML 2.0, Azure AD Group synchronization, Integration for ConnectWise, HaloPSA, and Autotask), and the MXDR Permissions.

ABOUT HEIMDAL

YOUR HEIMDAL ACTIVATION KEY

This section displays the HEIMDAL Activation Key, the Expiration date, and its Status. 
The Generate Password button will show your Master Uninstall password (valid only throughout the day it was generated). It can be used to uninstall the HEIMDAL Agent in case you forgot the Uninstall Password that is set in the Group Policy settings. 

YOUR HEIMDAL API KEY

This section displays your personal API key that is available for your HEIMDAL Dashboard user account. The API Key can be deleted and generated again. You can also see a few guides on how to use the APIs HEIMDAL provides.

DOWNLOAD AND INSTALL

This section provides you with a list of the installers and some guides on how to use some of the HEIMDAL products/services.

CUSTOMER SETTINGS

This section allows you to configure customer-related global settings.

• Login Setup - allows you to set the Azure Login (see this article: https://support.heimdalsecurity.com/hc/en-us/articles/360019971018-SAML-2-0-Login) or Okta Login (see this article: https://support.heimdalsecurity.com/hc/en-us/articles/21698669567005-Okta-Login)
• Integrations - allows you to configure the ConnectWise PSA integration (see this article: https://support.heimdalsecurity.com/hc/en-us/articles/16883467334045-HEIMDAL-and-ConnectWise-PSA), the HaloPSA integration (see this article: https://support.heimdalsecurity.com/hc/en-us/articles/20040078821661-HEIMDAL-and-HaloPSA), or the Autotask integration (see this article: https://support.heimdalsecurity.com/hc/en-us/articles/20552894807197-HEIMDAL-and-Autotask);
• Company Info - allows you to set a company logo (png, jpg, but it would be ideal to be with a transparent background), which will be displayed on the HEIMDAL Dashboard login page (next to the HEIMDAL logo), on the HEIMDAL Dashboard left-side menu and in the templates for Alerts and Reports (which are configured in the Reports section, when choosing custom logo),on Heimdal Agent co-branding scenario, when the agent menu is expanded. Each HEIMDAL Dashboard user (reseller or enterprise role) will always see their configured logo (in case a reseller uploads a custom logo, all HEIMDAL Dashboard users linked to that reseller, which have the "Reseller Logo Distribution" feature enabled will see the reseller's logo).
  
  
• Azure AD Sync - allows you to apply HEIMDAL Group Policies based on Azure AD Group membership (see this article: https://support.heimdalsecurity.com/hc/en-us/articles/4402377573137-Synchronizing-Azure-Active-Directory-Groups-Windows);
• PEDM Primary Users - allows you to configure the Azure AD (Entra) PEDM Primary Users application that will fetch the Azure AD Group membership for the PEDM Primary Users functionality.

MXDR PERMISSIONS

This section is meant for MXDR customers to configure the permissions that the HEIMDAL MXDR Team can use to act on detections. 

• Managing Dashboard Data Visibility

If you do not want Heimdal to access your Dashboard data, deselect the checkbox below.

Please note that if this option is disabled, Resellers will still be able to access the Dashboard data for the customers within their portfolio.

REPORTS

The Reports section is split into three categories: On-demand reports, Scheduled reports, and Alerts management. 

A. On-demand reports

The On-Demand Reports section is dedicated to manual report generation, filtering options, and data visualization for Detailed products, C-Level reports, NIS2 reports, and Cyber Essentials reports (for both Enterprise/Corporate customer and Reseller-type user accounts). 


The Standard view includes a table with the following details: Report type (C-Level, Detailed, NIS2 and Cyber Essentials), Included modules, Customer (in the case of a Reseller), Selected start/end date (this date considers the report's timezone settings), Generated start/end date (this date considers the report's timezone settings), Timestamp (the timestamp when the report has been generated), and Status (can be Queued, Queue Failure, Processing, Failed, Download).

The Filters functionality allows you to filter entries by Operating System. 

The Generate on-demand report button will guide you through the setup of a new report type generation, which can be a Detailed product report, C-Level report, NIS2 report, and Cyber Essentials report. 
After choosing a report type, you can select the products you want to be included in the report:




If you are generating a report at the Reseller-level, you will have to specify the Enterprise customer(s) that the report is/are generated for. The next step is to choose the report details: timeframe, time zone, date format, language, currency, and logo (custom logo or HEIMDAL logo).

B. Scheduled reports

The Scheduled reports section is dedicated to the automatic report generation, filtering options, and data visualization for Detailed products and C-Level reports (for both Enterprise/Corporate customer and Reseller-type user accounts. 


The Standard view includes a table with the following details: Report type (C-Level or Detailed), Included modules, Customer (in the case of a Reseller), Timestamp (the timestamp when the report has been generated), Scheduled, Scheduled by, Recipients, and Actions (Edit or Delete).

The Filters functionality allows you to filter entries by Operating System. 

The left-side selector allows the user to apply the Delete action on one or more entries listed in the table.

The Generate scheduled report button will guide you through the setup of a new report type generation, which can be a Detailed product report, C-Level report, NIS2 report, and Cyber Essentials report. After choosing a report type, you can select the products you want to be included in the report:

If you are generating a report at the Reseller-level, you will have to specify the Enterprise customer(s) that the report is/are generated for. The next step is to choose the report details: email address (can be an internal or external address), timeframe, time zone, date format, language, currency, and logo (custom logo or HEIMDAL logo).


To see what a report looks like, you can scroll down to the bottom of this article and download one of the 2 attached samples.

C. Alerts Management

The Alerts management section is dedicated to the live alerts that are being sent for each selected product that triggers a detection. 
The view includes a table with the following details: Customer (in the case of a Reseller), Recipient(s) (email address of the receiving user), REP, MU, GP, NGAV, VN, Zero-Trust, PEDM, and Actions (Edit or Delete).

The Set up alerts button will guide you through setting up a new alert configuration for a specific customer (or more) that should be sent to a recipient or more. 
An Enterprise customer would be presented with a modal that allows them to select the products for which alerts should be generated. 

If you are a Reseller, you need to specify one or more customers first and then select the products that should be monitored.

The next step is to configure the recipient's email address, time zone, date format, language, and logo (custom or HEIMDAL).

To see what an alert looks like, check out the samples below:

IMPORTANT

Alerts are generated by a job that runs on our servers every hour. This means that once an event is detected, the alert will be sent out as an email notification when the job runs again (in a specific case, if a detection is made at 12:10 PM and the job ran at 12:05 PM, the alert will be sent at 1:05 PM, when the job runs again). Endpoint Detection reports can include detections/warnings that extend to 31 days (ignoring the configured timeframe). 

TOGGLE THEME

The Toggle Theme button allows the logged-in user to switch between the light theme and the dark theme (in case the customer that the user is assigned to does NOT have the Threat-hunting & Action Center product on its license. In the case of customers who already have the Threat-hunting & Action Center product will not see this option in the left-hand side menu. 

SUPPORT

The Support button redirects you to the HEIMDAL Security Support and Knowledge Base section, where you can find support articles for all of our products and solutions to known problems. In this section, you can also get in contact with our Support Team (via the customized forms).