Onboarding and Self-Service

Arctic Wolf Unified Portal Telemetry Management

Updated Jan 26, 2024

Verify scanning health

On a monthly or quarterly basis, review IVA Scanner and Arctic Wolf® Agent scanning health:

Check IVA Scanner connectivity

Arctic Wolf alerts you if an IVA Scanner goes offline, but you can manually check IVA Scanner connectivity at any time.

  1. Sign in to the Arctic Wolf Unified Portal.

  2. Click Telemetry Management > Scanners.

  3. Find the IVA Scanner you want to check.

  4. In the Status column, if the value is:

    • Disconnected — Make sure the network scanner is online and that the network communication is not blocked. For example, by a firewall.

      See the Unified Portal Allowlist Requirements page for a list of IP Addresses and Ports that Arctic Wolf requires on an allowlist. Contact your Concierge Security® Team (CST) at security@arcticwolf.com if you require additional troubleshooting.

    • Degraded — Restart the network scanning appliance. If it comes back online and the status is still Degraded, contact your CST at security@arcticwolf.com.

Check the IVA Scanner rate

Make sure assets are scanned at an appropriate interval. In general, a scanner scans approximately 150–250 assets in an 8-hour period. The number of assets changes based on the type of system and environment. For example, if several large subnets of assets are scanned weekly in an 8-hour scan window, it can take more than a month to complete a full cycle of scanning.

If you have concerns about your environment not being scanned in a timely manner, contact your CST at security@arcticwolf.com to review the scheduling. To optimize scanning without increasing the scan window, you can deploy additional physical scanners. This allows you to scan multiple subnets in parallel. Adding resources to virtual scanners does not result in any meaningful increase in scan throughput because they would consume additional resources.