Troubleshooting Coverage Map

The Coverage Map shows which governance controls are active, which systems contribute evidence, and where your coverage has gaps. When the Coverage Map does not reflect expected data, the most common causes are an uninitialized registry, connectors that have not run recently, or control packs that have not been installed or evaluated.

Coverage Map shows no data

Symptom:The Coverage Map page loads but shows a blank grid, all controls listed as Uncovered, or a message such as "No coverage data available for this workspace".

1. 1

   Check whether the coverage registry has been initialized

   The Coverage Map requires a coverage registry to be bootstrapped for your workspace. If the registry was never initialized (common on new workspaces), the map will be empty. Go to Settings > Coverage Registry and check for an Initialize button. Click it to run the first bootstrap.

2. 2

   Install at least one control pack

   The Coverage Map is only populated when control packs are installed and have run. If no control packs are installed, there are no controls to map. Go to Control Packs and install at least one pack appropriate for your environment.

3. 3

   Run a control pack evaluation

   After installing a control pack, trigger a manual evaluation run. The Coverage Map updates after each evaluation. In Control Packs, open the installed pack and click Run Evaluation.

4. 4

   Connect at least one data source connector

   Coverage requires evidence from connected systems. If no connectors are connected, evaluations will produce empty results. Go to Integrations and connect the connectors relevant to your installed control packs.

5. 5

   Wait for post-evaluation indexing

   After an evaluation completes, coverage data takes up to 5 minutes to appear in the Coverage Map. Refresh the Coverage Map page after waiting.

Coverage registry not initialized

Symptom:The Coverage Map or an API endpoint returns "Coverage registry not initialized" or the Coverage Map page shows a prompt to initialize before proceeding.

1. 1

   Navigate to Settings > Coverage Registry

   In Nuxari, go to Settings and look for the Coverage Registry section. This page shows the current registry status.

2. 2

   Click Initialize Registry

   If the registry status shows 'Not initialized', click the Initialize Registry button. The initialization process runs in the background and typically takes 1–3 minutes for a new workspace.

3. 3

   Wait for initialization to complete

   After clicking Initialize, a progress indicator will show the initialization status. Do not navigate away from the page during initialization. When complete, the status will change to 'Active'.

4. 4

   Return to the Coverage Map after initialization

   After the registry status shows Active, navigate back to the Coverage Map. Install control packs and run evaluations to populate coverage data.

5. 5

   Contact support if initialization fails repeatedly

   If the Initialize Registry button produces an error or the initialization never completes, contact Nuxari support with your workspace ID and the time you attempted initialization.

Coverage score is lower than expected

Symptom: The Coverage Map shows a coverage percentage that is lower than you expect given the control packs you have installed and the connectors you have connected.

1. 1

   Identify which controls are marked as Not Covered

   In the Coverage Map, filter by status 'Not Covered' or 'Gap'. Review the list of controls that are not producing evidence. These are the specific items pulling your score down.

2. 2

   Check whether the relevant control pack evaluation has run recently

   A control that was previously covered can drop to Not Covered if the last evaluation is stale. For each uncovered control, check when its associated control pack last ran. If it is more than 24 hours old, trigger a fresh evaluation.

3. 3

   Verify the connector contributing data to that control is healthy

   Each control in a pack depends on one or more connectors to provide evidence. If the connector is disconnected or has errors, the control will show as Not Covered even though the pack is installed. Fix the connector and re-run the evaluation.

4. 4

   Check for controls that require an Edge Agent

   Some controls (particularly from the Linux Posture Pack or on-premises packs) can only be covered by an Edge Agent, not a cloud connector. If you have not deployed an agent for those systems, those controls will remain uncovered until an agent is deployed and assigned.

5. 5

   Review the coverage calculation method

   Coverage score is calculated as: covered controls / total active controls. If you have recently installed a new control pack with many controls but have not yet run it, those controls are counted in the denominator but have no evidence — lowering the percentage. Run all newly installed packs to close the gap.

Control appears missing after template install

Symptom: You installed a control pack or template but one or more specific controls that should have been added are not visible in the Coverage Map or the control list.

1. 1

   Refresh the Coverage Map page

   The Coverage Map can take up to 5 minutes to reflect newly installed controls. Force-refresh the page (Ctrl+Shift+R or Cmd+Shift+R) rather than just reloading to clear any cached state.

2. 2

   Check whether the control is filtered out

   The Coverage Map has filter options for control category, status, and source. If a filter is active that excludes the newly added control's category or framework, it will not appear in the current view. Clear all filters to see the full control list.

3. 3

   Verify the control pack installation completed fully

   Go to Control Packs and open the pack you installed. Confirm it shows a status of Installed, not Partially Installed or Failed. If the installation did not fully complete, some controls in the pack may have been skipped.

4. 4

   Trigger a manual evaluation of the newly installed pack

   Newly installed control packs do not run automatically until their scheduled time or until manually triggered. Click Run Evaluation in the control pack detail. After the evaluation completes, the controls should appear in the Coverage Map.

5. 5

   Check whether the control requires a specific connector that is not yet connected

   Some controls are only added to the Coverage Map if their required data source is connected. If the control requires a connector you have not yet set up, the control may be registered but hidden until the data source is available. Connect the required connector and re-run the evaluation.

Edge Agent not contributing coverage

Symptom: An Edge Agent is Active and heartbeating, a control pack is assigned to it, but the Coverage Map still shows the controls that agent should cover as Not Covered or with no evidence.

1. 1

   Verify the control pack is explicitly assigned to this agent

   In Settings > Edge Agents, open the agent detail. Under 'Assigned Control Packs', confirm the relevant pack is listed. If not, click Add Control Pack and assign it. The agent will pick up the assignment on its next heartbeat.

2. 2

   Trigger a manual collection run

   After assigning a control pack to an agent, trigger a manual evaluation from the Control Packs page. Select the pack, click Run Evaluation, and select the specific agent as the target. This forces an immediate collection rather than waiting for the next scheduled cycle.

3. 3

   Review agent collection logs for errors

   On the agent host, check the agent log file for any collection errors after the pack was assigned. Look for 'permission denied', 'file not found', or 'check failed' messages that indicate the agent encountered a problem collecting data for a specific check.

4. 4

   Confirm the agent user has the required OS permissions

   The agent process user must have read access to the OS resources the control pack checks. For the Linux Posture Pack, this typically includes /etc/passwd, /etc/sudoers, systemd service state, and local firewall rules. Grant the necessary read permissions without granting write access.

5. 5

   Wait for coverage data to index after a successful collection

   Even after a successful collection, coverage data takes up to 5 minutes to appear in the Coverage Map. After the agent logs show 'collection completed successfully', wait 5 minutes and refresh the Coverage Map.