Configuring the Internal Vulnerability Scans application
The Internal Vulnerability Scans application has several configuration options available. The configuration options include a scan intensity control and the ability to schedule when scans occur by specifying specific hours, days, or months with a no-scan setting.
This page describes both the general application settings and the authentication credentials you can specify on the Authenticated Scans tab. The authenticated scan settings are provided to meet the Payment Card Industry Data Security Standard (PCI DSS v4.0.1) requirement 11.3.1.2 for authenticated scans, which took effect March 31, 2025. Scale Computing provides the ability to run authenticated vulnerability scans on your devices.
Scan configuration is the operator-facing entry point into the broader SC//Reliant™ platform vulnerability management strategy. The cadence, intensity, and credential coverage set here determine what gets discovered, how often, and at what depth, which in turn drives the findings that flow into the central tracker for CVSS-based triage and remediation against the platform's documented SLAs (Critical/High: 30 days, Medium: 90 days, Low: 180 days). Authenticated coverage in particular materially expands what OpenVAS can see at each site, producing richer findings for compliance evidence and for downstream patch decisions.
You can reach out to Scale Computing Support for assistance making changes to the Internal Vulnerability Scans application settings.
Configuring the Internal Scans application
SC//AcuVigil™ provides several settings to configure the Internal Scans application. You should engage the Scale Computing Customer Support Center (CSC) if you'd like to update any of the following settings.
| Setting | Description |
|---|---|
| Enable Scans | Turns the Internal Scans application on or off. |
| Promote Scan Status | Determines whether the AcuVigil location tile status color reflects the Internal Scans application status. |
| Discover Intensity | Controls the speed of the discovery scan phase. |
| Version Detection | Turns the Nmap version detection feature on or off during the discovery phase. |
| Exploit Scanner Type | Determines the scanner type to use. The Local option should be used for the SC//Reliant platform. The Cloud option is selected by default, so ensure that if you're scanning devices on the SC//Reliant platform that you change this setting to Local. |
| Scan Segments | A dynamically generated list of network segments at the location. Selected network segments are scanned. This setting doesn't apply to devices on the SC//Reliant platform. |
| Exclude Hosts | A dynamically generated list of devices at the location. Selected devices will be excluded from being scanned. This setting doesn't apply to devices on the SC//Reliant platform. |
| No-Scan Hours | The hours of the day to exclude devices from being scanned. This setting uses the 24-hour notation. |
| No-Scan Days | The days of the month to exclude devices from being scanned. |
| No-Scan Months | The months of the year to exclude devices from being scanned. |
Understanding the Discover Intensity setting
The Discover Intensity controls the speed of the discovery scan. A value of 1 is the slowest and least resource intensive while a value of 10 is the fastest and creates the greatest network burden. The following table shows the approximate minimum intensity required to perform a complete scan of all devices in one scan cycle (month).
| Devices | Discover Intensity | Scan Concurrency |
|---|---|---|
| 1-5 | 1 | 1 |
| 6-10 | 2 | 2 |
| 11-20 | 3 | 3 |
| 21-45 | 4 | 5 |
| 46-70 | 5 | 8 |
| 71-100 | 6 | 13 |
| 101-160 | 7 | 21 |
| 161-280 | 8 | 34 |
| 281-490 | 9 | 55 |
| 491+ | 10 | 89 |
Managing your credentials for authenticated scans
The Internal Vulnerability Scans app is able to use the credentials for the devices connected to your SC//Reliant platform edge device to do a deeper scan. A more in-depth authenticated scan may enrich the scan findings with additional vulnerabilities.
The following sets of credentials can be specified in the Internal Scans app configuration page for each location within SC//AcuVigil. The credentials are securely encrypted and stored. We recommend using the Retention Policy setting to define how long Scale Computing stores your credentials.
- SSH - The SSH credentials are for devices that are accessed over SSH using a username and password.
- SSH Private Key - The SSH Private Key credentials are for devices that are accessed over SSH using an SSH key pair.
- Microsoft Windows Account - The Microsoft Windows Account credentials are used to access a Microsoft Windows system or Samba shared folder.
- ESXi - The ESXi credentials are used for authenticating to a VMware ESXi host.
- SNMPv1/SNMPv2 - The SNMPv1 or SNMPv2 credentials are used to access a device over the SNMPv1 or SNMPv2 protocol, such as a router or switch.
- SNMPv3 - The SNMPv3 credentials are used to access a device over the SNMPv3 protocol, such as a router or switch.
Next step
Once the Internal Scans application is configured and running, you can use SC//AcuVigil to view the vulnerability scan results. For more information, see Viewing vulnerability scan results.