Enterprise Recon 2.4

Distributed Scan

This section covers the following topics:

You can use ER2 to perform a distributed scan on a Target or Target location using a group of Proxy Agents. Distributed scans allow you to:

  1. Improve scanning time by having multiple scanning processes executed in parallel.
  2. Optimize resources by distributing the scanning load across multiple Proxy Agent hosts which might otherwise have been unutilized.

Distributed scans are particularly useful for scanning Targets that have a vast number of locations, for example:

  • An Exchange Server with thousands of mailboxes.
  • A Microsoft SQL Server with hundreds of databases, with thousands of tables per database.

For more information, see Distributed Scan Requirements below.

How a Distributed Scan Works

When a distributed scan starts, the Master Server begins by collecting information about the Target(s) and the Proxy Agents in the Agent Group assigned to the scan. The Master Server uses this information to break down the Target(s) into smaller components or sub-scans, then proceeds to distribute the scan workload among the Proxy Agents that are online and available.

Each Proxy Agent then starts to execute the assigned sub-scans on the Target(s). Results for the Target(s) are progressively processed and displayed in the Web Console as each sub-scan completes. If any Proxy Agent becomes idle (after completing all assigned tasks) or is newly connected while the distributed scan is still in progress, outstanding tasks from other Proxy Agents are dynamically reallocated to these available Agents to further improve the overall scan time.

A distributed scan schedule is marked as "Complete" only when all sub-scans distributed among all Proxy Agents have been completed.

Distributed Scan Requirements

Proxy Agent Requirements

To perform a distributed scan on a Target or group of Targets, you need to Create an Agent Group to be assigned to the Target or Target location. Ensure that all Proxy Agents in the Agent Group:

  • Have been upgraded to version 2.0.31 and above.
  • Support scanning of the Target platform.

Supported Targets

You can run a distributed scan on the following supported Target types:

Target Type Description
Windows Share Scans are distributed across the folders and files under the Path of the network storage location as specified in the scan schedule.
If the number of files under the Path exceeds a certain limit,
  • distributed scanning will be disabled for the scan schedule,
  • the change will be captured in the Activity Log, and
  • the network storage Path will then be assigned to a single Proxy Agent from the Agent Group.
Remote Access via SSH Scans are distributed across the folders and files under the Path of the network storage location as specified in the scan schedule.
If the number of files under the Path exceeds a certain limit,
  • distributed scanning will be disabled for the scan schedule,
  • the change will be captured in the Activity Log, and
  • the network storage Path will then be assigned to a single Proxy Agent from the Agent Group.
IBM DB2 Scans are distributed across the tables in the database.
InterSystems Caché Scans are distributed across the tables in the database.
MongoDB Scans are distributed across the collections in the MongoDB Server.
MariaDB Scans are distributed across the tables in the database.
Microsoft SQL Server Scans are distributed across the tables in the database.
MySQL Scans are distributed across the tables in the database.
Oracle Database Scans are distributed across the tables in the database.
PostgreSQL Scans are distributed across the tables in the database.
SAP HANA Scans are distributed across the tables in the database.
Sybase / SAP ASE Scans are distributed across the tables in the database.
SharePoint Server Scans are distributed across the sites in the SharePoint Server.
Amazon S3 Buckets Scans are distributed across the Amazon S3 Buckets in the Amazon account.
Azure Storage Scans are distributed across the Blobs, Tables or Queues in the Azure Storage account.
Exchange Domain Scans are distributed across the mailboxes in the Exchange domain.
Exchange Online Scans are distributed across the mailboxes in the Microsoft 365 domain.
G Suite Scans are distributed across the users in the G Suite domain.
Rackspace Cloud Scans are distributed across the cloud server regions in the Rackspace account.
SharePoint Online Scans are distributed across the sites in the SharePoint Online domain.

Start a Distributed Scan

Running a distributed scan is the same as starting any other scan.

  1. Log in to the ER2 Web Console.
  2. Navigate to the Select Locations page by clicking on:
    • Scans > New Scan, or
    • the New Scan button in the Dashboard, Targets, or Scans > Schedule Manager page.
  3. On the Select Locations page, click + Add Unlisted Target. Follow the on-screen instructions to add a new Target.
  4. When prompted to select an Agent to act as proxy host, click on the Select proxy agent menu and select a suitable Agent Group.
  5. Click Test, and then Commit.
  6. On the Select Data Types page, select the Data Type Profiles to be included in your scan and click Next. See Data Type Profiles.
  7. Set a scan schedule in the Set Schedule section. Click Next.
  8. Review your scan configuration. Once done, click Start Scan.

Monitor a Distributed Scan Schedule

Distributed scans show up in the Targets page and Scans > Schedule Manager page in the Web Console just like any other scan. See View and Manage Scans for more information.