Skip to content

Guardian Classic

Get started 3 min read View Markdown

Prepare your network#

Stage 2 of getting started. Guardian's scanning services run on your network, whether your instance is hosted or on-premises. This checklist gets them installed, signed in and able to reach what they need.

Applies to: Guardian Classic Infrastructure teams

Set up scanning services#

Guardian scans a node by running commands on it, either through an Agent installed on the node or agentlessly through a Connection Manager. The results are the same, so you can mix the two; we recommend a combination. See Agent-based or agentless? and Supported Devices.

Agent-based#

Install the Agent on each node you want to scan. It polls the Guardian instance over HTTPS on port 443 every 10 seconds for work, and scans only the node it's installed on. Agent nodes appear under Inventory > Monitored once they're set up. See Guardian Agent.

Agentless#

A Connection Manager connects to your nodes remotely over SSH, WinRM or an API, and one Connection Manager can scan more than a hundred nodes. It can run on the Guardian appliance or as a satellite on your network. See Connection Managers.

Group your Connection Managers first

If you'll run more than one Connection Manager, set up Connection Manager groups before you add nodes. Connection Managers in a group share the load of scans and integration syncs.

Provision service accounts#

Applies to: Agentless scanning

Agentless scans sign in to each node with a service account. Without one that can use SSH or WinRM, scans fail with Access Denied; without enough permissions, they're incomplete. You need a service account even if you only use the built-in default Linux Connection Manager.

Linux
  • Can sign in over SSH.
  • Optionally, a local or domain administrator on the node. To scan CIS benchmarks, it needs root.
Windows
  • Can sign in over WinRM, with Execute (Invoke) permission. To grant it, run Set-PSSessionConfiguration -Name Microsoft.PowerShell -ShowSecurityDescriptorUI in PowerShell and add the service user.
  • Optionally, a local or domain administrator on the node.
  • Optionally, run the Connection Manager service as this user.
Database

Open your firewall#

Scanning services can't scan until your firewalls let them reach the instance and your nodes.

Scanning service Must reach
Every Agent and Connection Manager The Guardian instance on port 443, to collect scan jobs and return results.
Linux Connection Manager Target nodes (Linux and Unix servers, SSH-capable network devices) on port 22, or whichever port their SSH servers use.
Windows Connection Manager Target Windows nodes on WinRM ports 5985 and 5986, and database nodes on the ports you use for ODBC.

Next#