Network Scan¶
Clarity Transform discovers live hosts by scanning agreed subnets for responses and open ports, then infers a device role from the services it finds.
Where to find it¶
Go to Discover → Integrations, then select the Network Scan card. The card's category label is Scanner. The integration's page has the Endpoints and History tabs; Integrations describes the page, its grid and its row actions.
Why we do this¶
A scan is how you find the machines nobody listed, which on most estates is a meaningful number.
It is also the fastest way to establish the shape of an environment at the start of an engagement, before the credentialed integrations have been through a security review.
What we collect¶
- Live hosts, by response to a probe
- IP and MAC addresses
- Open ports, and the services those ports imply
- An inferred device role, from the combination of services found
This is the integration to reach for when access is the blocker
Where a security review is holding up the credentialed integrations, this is a way to make progress in the meantime rather than waiting.
What it adds¶
Existence. A machine that is powered on and reachable exists, whatever the inventory says.
A listening port is also definitive evidence that a host offers a service, which is a useful input to application inference even without knowing who consumes it.
What is deliberately not inferred¶
- Nothing is authenticated to and nothing is logged in to. The scan probes; it does not connect as a user.
- No traffic content is captured.
- Nothing is written or changed anywhere.
- A listening port is not a dependency. It shows a service is offered, which is a different claim from evidence that anyone uses it.
- An inferred role is a hypothesis. A host with 1433 open is probably a database server; it is not proof of one, and the role is offered as a starting point rather than a fact.
A scan is visible to the customer's security tooling
Port scanning looks like port scanning.
What we require¶
The endpoint form has a Credential field. Whether the scan uses a credential is not shown in the UI.
Verification before handover¶
- Agree the scope in writing. The subnets and the time window. This is the verification step that matters for this integration, and it is a conversation rather than a technical check.
- Confirm the Clarity host can reach the subnets. A scan from a segment that cannot route to the target subnets returns an empty result rather than an error, which reads as an empty network.
- Warn the security team before the first run. So the traffic is recognised. Worth doing even where the scan has been formally approved, because approval and the on-call analyst are frequently not the same conversation.
Configuring the endpoint¶
On the integration's Endpoints tab, select the add icon (Create New Integration Endpoints). The Create new entry form opens with these fields, in this order:
| Field | Value |
|---|---|
| Name | A name for the endpoint |
| End Point | The subnets to scan, in CIDR form |
| Credential | None. The form marks no field as required |
| Job Schedule | A five-field cron expression, for example 0 2 * * 0 (weekly). Agree the window with the security team |
| Enabled | Ticked. The box is unticked when the form opens |
The help texts: End Point "FQDN or IP Address of management system for technology e.g. vCenter, Nutanix Prism"; Credential "Credentials can be configured under Settings/Identity and Access Management/Credentials."; Job Schedule "Cron schedule – Use five fields: 〈mm〉 〈hh〉 〈day-of-month〉 〈month〉 〈weekday〉".
The Credential list offers the credentials stored under Settings → Identity & Access Management → Credentials.
The form has no subnet, port-list or IP-range field beyond End Point.
No field is marked as required. Technology is set by the card and is hidden in the form. Select Save to create the endpoint, or Cancel to close the form. The edit icon opens the same fields as Edit entry.
Removing the access¶
In Clarity, clear the endpoint's Enabled box, or remove it: select its row on the Endpoints tab, then Remove selected.
Troubleshooting¶
| Symptom | Cause |
|---|---|
| An empty result rather than an error | The Clarity host cannot route to the target subnets. Check reachability before concluding the network is empty. |
| A security incident raised | Expected where the scan was not announced. Agree the subnets and window in advance. |
| Fewer hosts than expected | A host firewall dropping probes silently, or a host powered off during the window. Neither produces an error. |
| A role looks wrong | The role is inferred from open ports and offered as a hypothesis. Correct it, or corroborate with host-level discovery. |
Related pages¶
- Infrastructure Discovery and Infrastructure Services: their Discovered Services (Listening Ports) charts show the services found by network scans. Until a scan has found any, they read "No discovered listening-port services yet. Run a network scan."