The Internal Vulnerability Scans application has several configuration options available. The configuration options include a scan intensity control and the ability to schedule when scans occur by specifying specific hours, days, or months with a no-scan setting.
This page describes both the general application settings and the authentication credentials you can specify on the Authenticated Scans tab. Payment Card Industry Data Security Standard (PCI DSS v4.0.1) requirement 11.3.1.2, which took effect March 31, 2025, requires authenticated internal scans. To meet this requirement, Scale Computing™ lets you run authenticated vulnerability scans on your devices.
Configuring the Internal Scans application
SC//AcuVigil™ provides the following settings to configure the Internal Scans application.
Note: To change any of these settings, contact Scale Computing Support. Open a ticket in the SC//AcuVigil dashboard, email team@scalecomputing.com, or call (512) 687-7401. |
| Setting | Description |
|---|---|
| Enable Scans | Turns the Internal Scans application on or off. |
| Promote Scan Status | Determines whether the SC//AcuVigil location tile status color reflects the Internal Scans application status. |
| Discover Intensity | Controls the speed of the discovery scan phase. |
| Version Detection | Turns the Nmap version detection feature on or off during the discovery phase. |
| Exploit Scanner Type | Determines the scanner type to use. Use the Cloud option for the SC//AcuVigil platform. Use the Local option for the SC//Reliant Platform. The VMWare option isn't used at this time, so you can ignore it. Cloud is selected by default. If you're scanning devices on the SC//Reliant Platform, change this setting to Local. |
| Scan Segments | A dynamically generated list of network segments at the location. Selected network segments are scanned. This setting doesn't apply to devices on the SC//Reliant Platform. |
| Exclude Hosts | A dynamically generated list of devices at the location. Selected devices are excluded from scanning. This setting doesn't apply to devices on the SC//Reliant Platform. |
| No-Scan Hours | The hours of the day during which devices aren't scanned. This setting uses 24-hour notation. |
| No-Scan Days | The days of the month during which devices aren't scanned. |
| No-Scan Months | The months of the year during which devices aren't scanned. |
Understanding the discover intensity setting
The Discover Intensity setting controls the speed of the discovery scan. A value of 1 is the slowest and least resource-intensive, while a value of 10 is the fastest and creates the greatest network load. The following table shows the approximate minimum intensity required to perform a complete scan of all devices in one scan cycle (month).
| Devices | Discover Intensity | Scan Concurrency |
|---|---|---|
| 1-5 | 1 | 1 |
| 6-10 | 2 | 2 |
| 11-20 | 3 | 3 |
| 21-45 | 4 | 5 |
| 46-70 | 5 | 8 |
| 71-100 | 6 | 13 |
| 101-160 | 7 | 21 |
| 161-280 | 8 | 34 |
| 281-490 | 9 | 55 |
| 491+ | 10 | 89 |
Managing your credentials for authenticated scans
The Internal Vulnerability Scans application can use the credentials for the devices connected to your Scale Computing edge security device (ESD) to run a deeper scan. An authenticated scan can find additional vulnerabilities that an unauthenticated scan misses.
Users with the Admin or Support Manager role can specify the following sets of credentials on the Internal Scans application configuration page for each location in SC//AcuVigil. The credentials are encrypted and stored. In the Retention Policy section, use Retain Credentials For to choose how long Scale Computing keeps them: from 1 to 11 months, 1 year, or Indefinitely. The default is 3 months.
- SSH - The SSH credentials are for devices that are accessed over SSH using a username and password.
- SSH Private Key - The SSH Private Key credentials are for devices that are accessed over SSH using an SSH key pair.
- Microsoft Windows Account - The Microsoft Windows Account credentials are used to access a Microsoft Windows system or Samba shared folder.
- ESXi - The ESXi credentials are used for authenticating to a VMware ESXi host.
- SNMPv1/SNMPv2 - The SNMPv1 or SNMPv2 credentials are used to access a device over the SNMPv1 or SNMPv2 protocol, such as a router or switch.
- SNMPv3 - The SNMPv3 credentials are used to access a device over the SNMPv3 protocol, such as a router or switch.
Next step
Once the Internal Scans application is configured and running, you can use SC//AcuVigil to view the vulnerability scan results. For more information, see Viewing vulnerability scan results.