Onboarding and Self-Service


Arctic Wolf Unified Portal Scan Schedules

Updated Feb 2, 2024

Create a scan schedule

You can create a new Internal Vulnerability Assessment (IVA) or Agent scan schedule:

Create an IVA scan schedule

  1. Sign in to the Arctic Wolf Unified Portal.

  2. Click Telemetry Management > Scan Schedules.

  3. Click Create New Scan Schedule.

  4. In the Source list, select Internal Scanner.

  5. In the Info section, enter a name and description for the schedule.

  6. In the Schedule section, configure these settings:

    • Priority — Select one of these options:
      • Low — The scan runs after all other scans are complete.
      • Medium — The scan runs after high priority scans but before low priority scans.
      • High — The scan completes before all other scans.

        Notes:

        • The priority of a scan is used when there are conflicting scan schedules, to determine which scan schedule should be applied. For example, if a target is covered under a daily and a weekly scan, the one with the higher priority would go first. If the priority is the same value, the least recently scanned target is selected. If both schedules are equally least recently scanned, the scans are performed in alphabetical order.
        • If there is a high priority scan that does not complete in the scanning time window, any low or medium scans never run.
        • If you start a new high priority scan when a low priority scan is in progress, the high priority scan will run after the current scan is complete. Any in-progress scan will complete before the new scan starts.
    • Frequency — Select one of these options:
      • Daily — The scan runs one time each day.
      • Weekly — The scan runs one time each week.
      • Monthly — The scan runs one time each month.
    • Scan Time — Select the time that you want the scan to start. The time is set using a 24-hour clock.
    • On — Select the days of the week or the day of the month that you want the scan to run on.

      Note: This option is not available if the Frequency is Daily.

    • Scan Window — Select the scan window. The default value is 8.

      Notes:

      • If you schedule a large scan in a short window, the scan may never complete.
      • If a scan cannot complete within a scheduled window, the scan resumes where the previous scan stopped the next time the scan is scheduled to run.
  7. In the Scanner section, select which scanner will run the scan.

  8. In the Targets section, enter IP addresses or networks of the targets you want scanned.

    Notes:

    • You can add the IP addresses in a comma-separated list or as a range.
    • Hosts that match a scheduled target are only run at the scheduled time. The scanner does not scan them as part of its regular scanning queue
    • Only entries with the CIDR format X.X.X.X/Y are accepted in this field. If you only want to add a single host, enter the host as X.X.X.X/32.
    • Arctic Wolf® recommends scanning subnet ranges /24 and smaller, excluding /8, /16, or /20. Scanning these large subnet ranges will likely cause a timeout issue.
  9. Click Create Scan Schedule.

Create an Agent scan schedule

  1. Sign in to the Arctic Wolf Unified Portal.

  2. Click Telemetry Management > Scan Schedules.

  3. Click Create New Scan Schedule.

  4. In the Source list, select Agent.

  5. In the Info section, enter a name and description for the schedule.

  6. In the Scan Type section, select one or both scan types:

    • Vulnerability — Performs a complete vulnerability scan on the scan targets.
    • Benchmark — Performs a scan on the scan targets against best practices benchmarks.
  7. In the Schedule section, configure these settings:

    • Frequency — Select one of these options:

      • Daily — The scan runs one time each day.
      • Weekly — The scan runs one time each week.
      • Monthly — The scan runs one time each month.
    • Scan Time — Select the time that you want the scan to start. The time is set using a 24-hour clock.

    • On — Select the days of the week or the day of the month that you want the scan to run on.

      Note: This option is not available if the Frequency is Daily.

    • Scan Window — Select the scan window. The default value is 8.

      Notes:

      • If you schedule a large scan in a short window, the scan may never complete.
      • If a scan cannot complete within a scheduled window, the scan resumes where the previous scan stopped the next time the scan is scheduled to run.
  8. (Optional) If you want new Agents added to the schedule as they are deployed, in the Targets section, select Auto-Enroll newly deployed clients.

  9. In the Targets section, select one or more Agents to include in the scan schedule.

  10. Click Create Scan Schedule.