24. Compliance: heatmap and trends
This guide describes Lawliet 1.5.13.s (the current release). Screens, commands and procedures may change in later versions; the usage guide is updated with each release. Check the version your server runs under Settings > Platform or with ./lawliet version, and see the Releases page for what changed.
Two read-only views over completed scans. The heatmap shows, control by control, where the estate passes and fails right now. Trends shows how the score moved over time and which controls changed.
Permission for both: View compliance. Nothing on these pages changes anything, so no four-eyes applies.
24.1 The Heatmap tab#
Path: Compliance > Heatmap.
What you see:
- Tiles: Total controls, Compliance score, Failed controls, Critical / High failures, Drift items.
- Filters: Search controls..., framework (All frameworks), Platform (All platforms), Latest scan only, Include drift.
- Legend: Pass, Fail, Partial, N/A, and the drift marker.
- The grid (CONTROL HEATMAP): one row per control (Control, Framework, Severity), one column per scan, and Latest on the right. Each cell is coloured by the control's status in that scan. A drift marker on a cell means the status changed since the previous scan.
Procedure: find where a control fails#
- Open Compliance > Heatmap.
- Tick Latest scan only to see the current state, or leave it off to see history.
- Choose a framework and a platform to narrow the grid, or type part of the control ID or name in Search controls....
- Click a red (Fail) cell.
What you see: the Control status drawer with Control ID, Control, Framework, Category, Scan, Platform and Completed (the scan links to its result page). If the cell carries drift: "Drift detected: <type>" and the linked Review queue item #N, or "No operator review item created for this drift type."
- Follow the scan link and use its Fix plan to remediate (chapter 22).
If it fails:
| What you see | Cause | Fix |
|---|---|---|
| "No completed compliance scans" with Go to Compliance | Nothing to draw yet | Run a scan |
| "Failed to load heatmap" with Retry | API error or timeout | Press Retry; narrow the filters if the estate is large |
| Access denied | No View compliance | Ask an administrator |
24.2 The Trends tab#
Path: Compliance > Trends.
What you see:
- Tiles: Latest score, Score delta, Best score, Worst score, Regressions, Improvements.
- Filters: framework, Platform, Control ID (for example 1.1.1), Date from, Date to, Limit, Include control history ("slower - loads per-control status across scans"), and Reset.
- Score trend: a chart of the score per scan. Colour bands: green >=80%, amber >=60%, red <60%. "Scans with no score are excluded from this chart." Click a point (or a row in Scan history) to open that scan's Compliance score with Pass, Fail and Partial counts, and View full scan report.
- Framework summary: per framework, Scans, Latest score, Prev score, Delta.
- Scan history: Scan, Score, Schedule (or Ad-hoc for a scan started by hand), Completed.
- Control history (only with Include control history): Control, Framework, Latest, Status changed, and a strip of the control's status per scan. Changed marks controls whose status moved; Stable those that did not.
Procedure: show the trend for an audit period#
- Open Compliance > Trends.
- Choose the framework and, if needed, the platform.
- Set Date from and Date to to the audit period.
- Read Latest score, Score delta, Regressions and the Score trend chart.
- For a control-level account, tick Include control history and search the control.
To hand the result to an auditor, generate a report (chapter 25) or an evidence bundle (chapter 27).
If it fails:
| What you see | Cause | Fix |
|---|---|---|
| "No trend data" | No completed scan matches the filters | Widen the date range or clear filters with Reset |
| The page is slow | Include control history on a long range | Turn it off, or narrow the dates or the framework |
| Access denied | No View compliance | Ask an administrator |