Run your first internal scan

Your first internal scan shows the devices on your network, the services they expose and their vulnerabilities. It takes a few clicks from the probe page.

Goal

Start an internal scan with Meccanica Adda's stabilimento-treviglio probe, follow its progress and know where to read the results.

Prerequisites

• A Scout probe that is installed and Online. An offline probe cannot start a scan.
• The probe's target networks already configured.
• A valid licence for the probe or its group (trial or purchased).

Steps

1. Open the probe menu

   In the sidebar open Internal Probes, find the probe, open its actions menu and choose Run scan. The Launch internal scan window opens.

2. Confirm the networks

   In the Networks step the probe's networks are already ticked under Networks to scan. If the probe found other routed networks it can reach, they appear under Also reachable by the probe and you can add them. Click Continue.

3. Check the options

   The Options step has a single profile, Comprehensive internal scan: it discovers every reachable asset, fingerprints services and applications, checks for known vulnerabilities and reports what changed since the last scan. If the probe has Active Directory connected, you also see Include Active Directory, already switched on. Click Continue.

4. Read the review and start

   In the Review step the License card shows the assets already used and the capacity. If the probe belongs to a group with a pooled licence, you see the group's licence. Click Start scan.

5. Follow the progress

   The scan is queued and the probe picks it up on its next heartbeat (the probe checks in with RECON every 30 seconds). Open the scan and follow it phase by phase in Mapping Progress.

The seven phases

The probe always runs the phases in this order:

1. Network Discovery
2. Device Fingerprinting
3. Vulnerability Scanning
4. Segmentation Audit
5. Drift Detection
6. Compliance Assessment
7. Storing Results

If you left Include Active Directory on, the AD collection starts after the network scan.

Active checks during the scan

Result

When the scan completes, open the results. The Overview tab shows:

• Assets by Type, the breakdown of the devices found;
• Risk Assessment, with severity, posture and end-of-life systems;
• Probe Details, with the probe's status and last heartbeat.

Further down, the Internal Network Map shows the subnets, gateways and devices found.

Troubleshooting

• The probe does not accept the scan: if it is offline you see "The probe is offline. Bring it back online and try again.". Follow the guide for an offline probe.
• The scan sits in one phase for a long time: each scan has a time cap on the probe (about 55 minutes with the comprehensive profile). When it is reached, the probe closes the scan and still uploads the results it collected.
• The licence blocks the start: the review shows the licence state. See the guides on licences and on exceeding capacity.

Related articles