Scout: what it is and how it works

Summary

The Scout probe brings RECON inside your company network. It is a lightweight Linux agent that you install on one machine in the network. From there it finds the connected devices, identifies their operating systems and services, and checks them for known vulnerabilities: everything an external scan from the internet cannot see.

Scout talks to RECON over a single HTTPS connection that it always opens outbound, so you do not open any inbound port. It installs nothing on the servers, workstations and machines it analyses: it observes them over the network.

Chapters

Key points

• A lightweight Linux agent. Scout runs as a system service on a Linux machine in your network, for example a small virtual machine at the plant.
• Outbound only. The probe opens an HTTPS connection to recon.orizon.one on port 443. You need no port forwarding and no inbound ports, and RECON never opens connections into your network.
• A heartbeat every 30 seconds. The probe checks in every 30 seconds. That is how RECON knows it is alive, hands it the scans to run and receives the results.
• What it finds. During an internal scan Scout discovers the connected devices, identifies their operating systems and services, and looks for known vulnerabilities. If your company uses Active Directory, it can analyse that too.
• No agents on your devices. Servers, workstations and machines are analysed over the network; nothing is installed on them.
• What you need. One Linux machine with systemd per network segment, root access on that machine, outbound HTTPS to RECON, and a RECON account with access to internal scans.
• Where your probes live. In RECON, probes appear on the Internal Probes page in the sidebar, together with their status, for example Online.

Transcript

The full transcript (in Italian) is in the Transcript tab of the player.

Related articles