Scan profiles

Overview

A scan profile is a named set of scanner settings for one scan type, such as the ports a sweep probes, the port an SSH scan connects to, or a timeout for the whole scan. When you attach a profile to a schedule, every scan the schedule runs from the control plane uses the profile’s settings in place of the scanner defaults. Use profiles to tune scans for a network once and reuse the settings across many schedules.

Screen tour

Click to enlarge

The Created column shows when the profile was created.

Create a scan profile

1. Open Scanning and select the Profiles tab.
2. Click New Profile. The Create scan profile modal opens.
3. Enter a Name, for example Web ports sweep, and optionally a Description.
4. Choose the Scan type: SSH, SNMP, WMI / WinRM, Network sweep, Hypervisor (Proxmox) or VMware vSphere. A schedule can use the profile only when its target is scanned with this scan type. Network sweep profiles apply to targets with scan type Sweep; WMI / WinRM to WMI; VMware vSphere to VMware.
5. Enter the Scan config as a JSON object, or leave it empty to use the scanner defaults. Under the box, the modal lists the keys the selected scan type supports. See Scan config.
6. Keep Active ticked.
7. Click Create profile.

Click to enlarge

Scan config

The Scan config is a JSON object of optional settings. Every key is optional, and each key is accepted only for the scan types listed next to it.

Examples per scan type

Network sweep: probe web and SSH ports on a busy network with shorter probe timeouts.

{ "ports": "22,80,443,8000-8100", "concurrency": 50, "probe_timeout_ms": 750 }

SSH: hosts that listen on a non-standard port, with a 5-minute limit.

{ "port": 2222, "timeout_seconds": 300 }

SNMP: fail fast when polling many devices.

{ "retries": 1, "request_timeout_seconds": 5 }

WMI / WinRM: WinRM over HTTPS with a 10-minute limit.

{ "port": 5986, "timeout_seconds": 600 }

Hypervisor (Proxmox): a large cluster on the default API port.

{ "port": 8006, "timeout_seconds": 900 }

VMware vSphere: a large vCenter inventory.

{ "port": 443, "timeout_seconds": 900 }

Validation

When you save, the modal first checks that the text is a JSON object: Scan config must be valid JSON. or Scan config must be a JSON object, for example { “timeout_seconds”: 600 }. The server then checks every key and value, and names the offending key in the error message. It rejects a config when:

• a key is unknown, for example unknown scan config key "depth" (supported keys for ssh scans: port, timeout_seconds),
• a key belongs to a different scan type, for example ports on an SSH profile,
• a key appears twice,
• a value has the wrong type or is out of range, for example scan config key "port" must be an integer between 1 and 65535.

DeviceQuest stores the config in canonical form, with sorted keys and without whitespace. When you edit the profile, the modal shows it pretty-printed.

Attach a profile to a schedule

1. On the Schedules tab, click New Schedule, or Edit on an existing schedule.
2. Choose the Saved target.
3. Choose a Scan profile. The list shows only profiles whose scan type matches the target’s scan type. Inactive profiles are marked (inactive). If none match, the hint reads, for example, No scan profiles for Network sweep scans yet. Create one on the Profiles tab.
4. Click Create schedule or Save changes.

To detach a profile, set Scan profile to None (scanner defaults).

If you change a schedule’s target to one with a different scan type, the modal clears the profile selection. The server also rejects a profile whose scan type differs from the target’s scan type.

When a profile is applied

DeviceQuest reads the schedule’s profile each time a scan starts, so edits apply from the next run. Each scan records one of these events in its Scan log (see Scan results):

• Applied scan profile "<name>": <config>: the profile was applied.
• Scan profile "<name>" is inactive; using scanner defaults.
• Scan profile "<name>" is for <type> scans but the target is scanned with <type>; using scanner defaults: the target’s scan type changed after you attached the profile.
• Could not load the schedule's scan profile (...): the scan runs with the scanner defaults.

Profiles apply to scans that a schedule runs from the control plane. A scan that a schedule sends to a bridge host agent runs with the agent’s own settings.

Edit a profile

1. Click Edit on the profile’s row. The Edit scan profile modal opens.
2. Change any field.
3. Click Save changes.

Click to enlarge

While schedules use the profile, its Scan type is locked and the hint reads, for example, Used by 2 schedules; detach it from them to change the scan type. To change the type, first set those schedules to another profile or to None (scanner defaults).

Clear the Scan config box to remove all overrides. Clear Active to pause the profile: it stays attached to its schedules, but they run with the scanner defaults until you make it active again.

Delete a profile

1. Click Delete on the profile’s row.
2. In the Delete profile dialog, check how many schedules use it, then click Delete profile.

Schedules that used the profile are detached and run with the scanner defaults.

Fields

Statuses

Related pages

• Schedules
• Scan targets
• Scan types
• Scan results