# Supply Chain Monitoring ## About the Data **Data Refresh Frequency:** Updated weekly on Sunday at around 02:00 UTC. Data can be up to 7 days old between refreshes. **Displays Data for:** Last 365 days **Minimum Requirements:** The _IQ Server_ instance should have at least 2 months of operational data for meaningful metrics. Refer to _Minimum Requirements_ for each metric in the corresponding sections below. ## Overview _Supply Chain Monitoring_ offers insights into the effectiveness of your _Lifecycle_ instance in protecting your open source supply chain. This is where you can review the health of your open source component supply chain periodically, and take corrective actions. The visualizations on this dashboard enable users to: 1. Check _Lifecycle_ adoption rate 2. Better manage critical vulnerabilities using _Lifecycle_ 3. Monitor the extent of protection offered by _Lifecycle_ on applications ## Get to Know Your Supply Chain Monitoring Dashboard ### Apps Onboarding This section indicates the increase or decrease in the number of applications being managed by _Lifecycle_, It provides a comparison of the number of applications being scanned and evaluated against _Lifecycle_ policies in the current and previous time periods. **Minimum Data Requirements for Meaningful Metrics:** No minimum To improve this score, refer to [Application Onboarding Best Practices](https://help.sonatype.com/en/onboarding-applications-best-practices.html). ### Risk Ratio _Risk Ratio_ is the average number of critical vulnerabilities per application per time period. It provides a comparison of the risk ratio measured in the current and previous time periods. **Minimum Data Requirements for Meaningful Metrics:** No minimum To improve this score, refer to [Remediate and Reduce Security Risks](https://help.sonatype.com/en/creating-a-lifecycle-remediation-plan.html#remediate-and-reduce-security-risk). ### Scanning Rate _Scan Rate_ indicates the average no. of scans per application in one month. It provides a comparison of the scanning rate measured in the current and previous time periods. **Minimum Data Requirements for Meaningful Metrics:** Data for at least 45 days To improve this score, refer to [Improve Scanning Rate](https://help.sonatype.com/en/continuous-monitoring-concepts.html). ### Scanning Coverage _Scanning Coverage_ indicates the percentage of applications scanned in build, stage-release, release or operate stage, at least once per week. It compares the current scanning coverage to the previous, to indicate if the recommended best practice of scanning applications at least once per week, has improved or declined. **Minimum Data Requirements for Meaningful Metrics:** Data for at least 45 days To improve this score, refer to [Improve Scanning Coverage](https://help.sonatype.com/en/continuous-monitoring-concepts.html). ### Discovery Rate _Discovery Rate_ indicates the number of critical vulnerabilities detected by _Lifecycle_ in the specified time period. It compares the current discovery rate to the previous. An increase in the discovery rate means that teams need to reconsider their component choices or consider applying waivers. A decrease in the discovery rate indicates that the component choices are getting better. **Minimum Data Requirements for Meaningful Metrics:** Data for at least 45 days To improve this score, refer to [Use Safer Components](https://help.sonatype.com/en/component-details-page.html). ### Fixing Rate _Fixing Rate_ indicates the percentage of critical vulnerabilities fixed per application in the specified time period. It compares the current Fixing Rate to the previous to indicate an improvement or decline in the teams efforts of addressing critical vulnerabilities. **Minimum Data Requirements for Meaningful Metrics:** Data for at least 45 days To improve this score, refer to [Remediating Vulnerabilities](https://help.sonatype.com/en/creating-a-lifecycle-remediation-plan.html#remediate-and-reduce-security-risk). ### Backlog Rate _Backlog Rate_ is the ratio of critical vulnerabilities fixed to critical vulnerabilities detected during the specified time period. A _Backlog Health_ score below 100 indicates that remediation is slower than the discovery rate. **Minimum Data Requirements for Meaningful Metrics:** Data for at least 45 days To improve this score, refer to [Improve Backlog Rate](https://help.sonatype.com/en/policy-concepts.html#picking-better-components). ## Filter Options You can select the dates to compare from the filter options. ## Additional Supported Operations You can download the underlying data by clicking on the _kebab_ (3 vertical dots) icon on the right top corner of this dashboard. Using the option, _Schedule Delivery_ as shown below, you can send the dashboard data to multiple email addresses in the preferred format. Supported formats include PDF, CSV or a PNG zip file. Use the _Recurrence_ and time field to set the timing of your data delivery options. | | | --- | | | ## Troubleshooting **Problem** Clicking on the browser _Refresh_ button may give you the following error: **Solution** Click the _Back_ button on your browser, from the page where you see this error, to go back to the Landing page _Enterprise Reporting_. Select the dashboard you want to view, to reload the visualizations. To refresh the page, click on the refresh icon on the top right, instead of the _Refresh_ button on your browser. **Problem** No data visible on the dashboard or any other issues with the dashboard. **Solution** Click on _Copy to Support Info to Clipboard_ button and contact [support](https://support.sonatype.com/hc/en-us) with this information.