Manage devices

Devices #

Filter the device inventory, then open a device to inspect its status and run an action. Uptime sorting covers up to 2,000 matching devices; devices without measurements sort last. Refused agent rows retain their full refusal reason in the Reason tooltip.

Saving or deleting a group changes the saved selection only. Deleting a group leaves its devices in inventory. If the list cannot be read, use Refresh; an unreadable list is not an empty inventory.

Device addition #

Add a device by its IPv4 address. Name, site and login are optional. A blank name is derived from the device type and address, such as camera-10-40-3-12. Cancel returns to the page that opened the form.

The login is saved encrypted in the vault. The saved login is also used when replacing the device’s hardware. If an address already belongs to a device, open the existing record instead of creating another.

Bulk addition #

Scan a network or import one device per CSV row. The optional header uses name, ip, type, vendor, model, site, network columns. Discovery classifies recognized devices and flags devices already in inventory.

Review the grid before creation. Invalid rows, duplicate entries and existing devices are skipped. Ambiguous site names remain unassigned until you choose a site. Apply batch assigns the chosen type, vendor, site or network across the batch; this is useful for identical devices at one site.

A shared device login is optional for inventory creation. Skans stores it per device in the vault. Certificate issuance needs a usable saved login and a supported driver; logins can be added later. Optional batch certificate issuance processes eight devices at a time and reports individual failures.

Agent enrollment #

Choose the platform, then use the corresponding installation method. Devices wait for approval on Devices. Their private keys remain on the endpoint. Codes disappear from the unused list when used, expired or canceled.

Windows domain installation uses the Skans deployment Group Policy. The policy installs the agent at the next restart or policy refresh; nothing is pushed into the PC. A workgroup Windows installation uses the signed MSI and a separately entered one-time code. The MSI installs the agent without placing the code on an msiexec command line. Read the license agreement before running an install command that accepts it.

A code is bound to the device hostname and has a limited lifetime. Copy it before leaving the page. Enter a Windows code at the hidden enrollment prompt; do not paste it into command lines, scripts, tickets or chat. Process auditing can record command-line arguments. Cancel an unused code to revoke it.

The Linux installer installs the appliance-published .deb or .rpm package, stores the appliance public certificate at /var/lib/skans-agent/skans-root.pem, pins trust to that certificate, enrolls the device and starts the agent. For manual enrollment, install the package first. The command begins with a space so shells using HISTCONTROL=ignorespace can omit it from history. Follow the platform-specific command shown in the console.

The device must resolve the appliance’s fully qualified name through DNS or a hosts-file entry. Agents connect to AgentHub. Publish a missing installer under Agent releases. A failure to load the appliance certificate is a separate fault from a missing release; use the reported error when investigating. Contact Skans support if an installer is unavailable or installation cannot complete.

Enrollment windows #

A window automatically approves up to its configured machine count until expiry or closure. Choose the smallest count needed for the deployment and close the window when finished. Machines admitted by a window can receive signed commands and content.

Linux and workgroup enrollment can use a site code, displayed once. Copy it before leaving. If admitted names include an unexpected machine, close the window and review the audit log for possible code disclosure. Opening and closing windows requires the Enroll devices permission.

Device detail #

An observed device has not yet been added for management. Adding it uses one licensed device and enables consideration by the network admission and port protection gates. Before addition, those gates refuse device admission or port protection.

A saved login refusal pauses authenticated jobs until the hold expires or an authorized user verifies the login again. Use Credentials to update the login. An unreadable detail page cannot establish device health: refresh it, then ask your administrator to investigate the reported fault if it persists.

Legacy SNMP permits MD5/DES. Disable it in Properties when the device supports SHA-2/AES.

Overview #

Retiring a device hides it and stops matching new data to it. It does not delete retained data, and the device can be restored.

Isolate disconnects the device from the network; Reconnect reverses that action. These actions require administrative permission and a confirmed, enforceable switch port. Skans does not isolate a device on its own. A recorded cable attachment alone does not establish an enforceable port.

Performance data appears after the first report. Telemetry contains bandwidth and sensors. Other saved passwords, such as BIOS or iLO credentials, and notes can be linked to the device.

Agent #

The agent reports Windows or Linux device details, inventory, antivirus, measurements, updates, security checks and logs, and runs backups. Install it through agent enrollment, then approve it. Until the OS has been reported, the console cannot choose PowerShell or bash.

Scripts run at the next check-in; results appear newest first. Database discovery is a separate scan. A backup configured to protect every discovered database protects none until discovery has populated that list. An empty completed database scan means only the explicitly configured files and folders are protected.

Backup history shows the latest result per job and backup type. The agent sends backup data over an encrypted, authenticated connection.

For Linux domain sign-in, an unspecified login group defaults to Skans-Linux-Login-(computer name) and an unspecified administrator group to Skans-Linux-Admin-(computer name). Skans does not create these domain groups. Create them and add the people allowed to sign in or use sudo.

Certificate #

A domain PC or server certificate is issued and renewed through the Windows domain certificate service. Use Issue certificate where no eligible certificate exists.

The device web certificate is the certificate presented by the device’s HTTPS listener, normally port 443. The Collector and its driver install it through the vendor interface. If the device does not answer, displayed values are the last recorded certificate, rather than a current observation.

Certificate requests #

Generate a request on the device. Its common name must be its enrolled IP address or verified DNS name. Signing uses the device TLS policy; the private key remains on the device.

Download the signed certificate and CA chain, then install them using the device management page. Signing a request does not install its certificate.

Device trust #

Device credentials are sent only to a recorded certificate or SSH host key. Camera credentials use HTTPS; a camera without HTTPS is refused rather than sent a password over plain HTTP.

Credentials #

The vault retains saved device logins. Showing or copying a password creates an audit record. Leave an existing password blank to keep it. Device passwords require at least eight characters. Saving a login alone does not verify it; verification runs through the Collector.

A controller write login needs local administrator permissions to change ports, VLANs and network admission settings. Leave Controller site blank to enumerate it; specify the site if several sites exist or the login cannot list them, including a 403 response.

For an existing SNMPv3 user, enter both authentication and privacy passphrases. The vault stores them for polling, and the form clears them after a successful save.

Turning on automatic password changes transfers management of that credential to Skans. Only credentials owned by Skans can be changed automatically. Record any video system or application sharing the login; shared recording-system credentials must not be rotated independently.

Password expiry uses the device’s observed answer. If the device still accepts a credential, an estimate based only on Skans’s last recorded change must not be reported as a confirmed expiry.

Saved logins and previously installed certificate records remain available even if the current driver catalog cannot verify certificate authentication. Check the driver pack and refresh before testing again.

Compliance #

Guidance follows the current baseline definition. Compare it with the measured values for this device. Unchecked or missing evidence is never counted as passing.

A failed control means the protection is not verified for this target. Compare actual and expected values, correct the fault through approved device management policy, and collect a fresh measurement from the same target. Service checks compare state and startup type; registry checks compare value, type and path. Read back the setting after remediation.

SMB signing limits unauthenticated traffic tampering. Legacy authentication permits downgrade and relay risks. UAC admin approval limits unintended elevation. RDP Network Level Authentication authenticates before a session opens. A stopped antivirus or firewall service removes its expected protection. Remote Registry permits changes to sensitive machine settings. Apply the organization’s approved policy for each setting.

Updates #

Automatic installation is off unless enabled. When off, Skans checks and reports. The device installs approved updates and reboots only within its maintenance window, in its own local time. Without a window, approved updates can install immediately. An unknown OS keeps OS-specific scheduling controls unavailable.

Use Check updates to request a scan, or wait for the weekly check. Install now requires an already downloaded and approved update. Approve it under Updates first. Removal runs at the next check-in and can require a reboot. Linux devices report package updates; installation is not managed here yet.

A smart card station is disabled by default. An approved station can issue user sign-in certificates, so approval grants credential issuance authority. Its agent requests a certificate using the SmartcardLogon template and writes the Windows domain strong mapping.

Logs #

Changes to agent log collection take effect at the next log send or check-in. Standard OS logs are collected by default. Debug messages are excluded, and collection resumes from its prior cursor.

A per-device rule can omit a Linux service or Windows log, or collect only warnings and errors. Filtering happens on the endpoint; removing a rule restores defaults. Be cautious with the Security log because failed sign-in and lockout alerts depend on it.

Application file tails are configured separately with a plain-text file path or wildcard. They are retained as a file:<path> channel alongside system logs. Video segment logs can produce high volumes; selecting warnings and errors reduces that volume. OS-specific standard logs appear after the OS report.

Open an event row for its full message, friendly fields and raw XML. An unreadable store is different from a quiet device: refresh and investigate the reason shown by the status tooltip.

Inventory #

Approved agents report hardware and software inventory every 24 hours; the initial list follows the next check-in. Windows exposes only the final five characters of its product key.

Vulnerabilities #

Vulnerability lookup requires a collected firmware version. An unknown firmware version cannot establish that a device has no known vulnerabilities.

Network #

Network segment and 802.1X sign-in describe devices attached to a switch, rather than the switch itself. Configure a supported controller under Network > NAC to collect those values. An unconfirmed port does not enable Isolate or Reconnect.

Telemetry #

vCenter health and managed inventory belong to the vCenter record. ESXi CPU, memory, NICs and hardware health belong to each host’s device page. vSphere polling runs about every five minutes. Some device classes do not provide CPU, memory or disk gauges. Measurements and history appear when reports arrive; truncation counts disclose omitted measurements.

Firewall #

Rules are evaluated from top to bottom; the first match wins. Built-in rules remain first to protect connectivity to the appliance. The current mode records what would match; it does not block traffic. A saved blocking setting is not proof of active enforcement. Other installed firewall software continues to enforce its own rules.

On Linux versions without per-service matching, a service-specific rule matches only its destination. Install and approve an agent before managing host firewall policy.

Internet connection reports #

These reports show attempted internet connections; they do not block them. TCP counts connection attempts. UDP counts destinations observed per check interval, about five minutes, regardless of packet count. Firewall contains the combined device list. Update agents older than the appliance’s minimum supported reporting version when reports remain absent.

Control ports #

Collector checks run daily from outside the device’s network. They open and close TCP connections without commands or login attempts, and skip UDP. Maintenance and change freezes pause checks. Existing findings remain open when checks are deferred or incomplete. Allowing an engineering-workstation path records an exception; it does not change a firewall rule.

Reboot settings #

Older agents may not report reboot state; upgrade the agent if that status is needed. Settings are still sent when status is absent. Holding stops reboots and update installation until Stop holding is selected; it has no automatic expiry.

Properties #

Coordinates are optional. The console uses no online map. The usual HTTPS management port is 443.

SNMP defaults to SHA-256 and AES-128. AES-192/256 use the Blumenthal draft. MD5/DES remain disabled unless legacy algorithms are allowed for the device. Changes are audited.

Automatic routing chooses the Collector assigned to the device’s network. An explicitly selected Collector that is later removed makes the device unreachable instead of silently rerouting it. Only the Collector or its DriverHost child opens device connections; the ControlPlane schedules work and never dials devices. Routing changes are audited.

Excluding a device from ISO 27001 reporting is an audited change.

Maintenance #

Active maintenance windows pause alerts. Canceling a window resumes alerts for every covered device. An unavailable maintenance store cannot establish that maintenance is absent: refresh and ask an administrator to investigate persistent read errors.

Supply-chain evidence #

Device API facts remain on the appliance. Confirmed means the device API reported the value; it does not certify compliance. Read facts uses the saved credential. Hardware and SoC details appear only when exposed by that device API. A missing supported fact may require a driver pack update.

Antivirus #

File and folder exclusions are applied by the device’s agent. Program and file-type exclusions are displayed here but must be changed on the endpoint.

Actions run at the next check-in. ClamAV downloads the definitions served by the appliance. Defender uses the cached definition package when one is available. An unreadable status or detection history does not establish that the device is protected or that it has no detections.