⬇️Getting Started with Posture
Connect your cloud environment, run your first posture scan, and triage access risk findings with P0 Security's posture management product.
With Posture, P0 automatically scans your cloud environment for access risks, such as overprivileged accounts, unused privileged access, and risky lateral-movement paths. This guide walks you through your first scan and shows you how to review, triage, and remediate the findings P0 surfaces.
Steps to get started
This guide provides the following sections to help you get up and running with Posture:
Setup takes about 15 minutes. Your first scan then runs in the background and may take additional time to complete, depending on the size of your environment.
This guide uses the following terms:
Monitor: A rule that P0 evaluates against your access graph to detect a class of access risk. P0 provides built-in monitors, and you can define your own.
Finding: A single issue that a monitor detects in your environment.
Set up an account
To create your P0 account:
Create a free P0 account at https://p0.app/create-account. All you need is an email address.
Set up a cloud integration through the guided onboarding flow (select Privilege Governance). You can skip this step and instead connect your cloud in the next step.
Connect your cloud and run your first scan
Posture findings come from a scan of your cloud environment. To connect a cloud provider, create an environment, and run your first scan, follow the steps in Creating an Environment.
If you already use P0 for just-in-time access, you still need to complete this step. Data collection for Posture requires different permissions in your cloud provider than access orchestration does.
When the scan completes, P0 evaluates its built-in monitors against your access graph and populates your findings. Select Dashboard to confirm that your first scan has finished.
A single environment and scan power both products. The same data also feeds Access Inventory, a queryable view of every identity, entitlement, and resource P0 collected. To explore it, see Getting started with Access Inventory.
Review your posture findings
Select Posture in the P0 app sidebar to see the results of each monitor.
By default, this page shows all open findings, ranked by severity. To narrow the list:
Select the filter icon to reveal the filter controls.
Use the Status dropdown to filter by finding status:
Open,Ignored, orResolved.Enable the Unassigned checkbox to show only findings that aren't assigned.
Narrow results to a specific target scope, such as an AWS account, Azure subscription, or GCP project.
To work through a single monitor, select it to open its Monitor Results page. This page shows the monitor's description, its history of new and resolved findings, and the full list of findings.
Start with your highest-severity monitors. P0 resolves findings automatically once they no longer appear in a later scan, so focus your first session on the issues that matter most.
Investigate and triage a finding
Select view next to a finding to open its details. From here, you can understand the risk and decide how to act on it.
For each finding, you can:
Review the attack path. P0 shows how an actor holding the identity can gain risky access to your system.
Review fix. For P0-provided monitors, P0 generates cloud shell commands that resolve the finding, such as replacing an overly permissive policy with a least-privilege one.
Assign. If you've connected P0 to Jira, assign the finding for resolution. P0 creates a ticket containing the finding description, its context, and any resolution commands.
Ignore. Document an acceptable risk. The finding no longer appears in your results unless you filter by
Ignoredstatus.Add notes. Record a business justification or other context directly on the finding.
You can assign, ignore, or review fixes for several findings at once from a monitor's results page using bulk actions.
Create a custom monitor
Beyond P0's built-in monitors, you can define custom monitors to enforce your organization's own access policies. A custom monitor starts from a query in the Access Inventory:
In the Inventory, select a show option and enter a where query.
When the results match what you expect, select Save Search.
Enable the Create a monitor for this search? toggle, then add a title, description, and severity.
P0 evaluates your custom monitor on every scan, and its results appear alongside the built-in monitors in Monitor Results. For full details, see Creating custom monitors.
What's next
If you run into any issues, contact support@p0.dev for help.
Now that you can review and triage posture findings, you can:
Connect P0 to a ticketing system to assign findings automatically
Connect P0 to your directory to enrich identity data
Add more cloud accounts and resources by creating additional environments
Start using P0's just-in-time access
Last updated