Running Authenticated Asset Groups Scans

Role Availability	Read-Only	Investigator	Analyst	Manager

An authenticated asset scan verifies scanned IPs within an Asset Group and detects vulnerabilities. Log in as administrator or root to perform an authenticated scan. See Managing Credentials in USM Anywhere for more information.

Warning: Keep in mind that an authenticated scan may fail if the local mail exchanger, which applies to Linux hosts, is enabled in the target asset.

Operating System	Method and Credentials	Escalation
Linux, BSD, Solaris, or macOS	SSH password or public key authentication	sudo or su
Windows	Windows username and password through Windows Remote Management	None

Asset Scan Credentials and Escalation Options

To run an authenticated asset scan from Asset Groups

1. Go to Environment > Asset Groups.

   • Next to the asset group name that you want to scan, click the icon , select Full Details, and then click Actions > Authenticated Scan. or
   • Next to the asset group name that you want to scan, click the icon and select Authenticated Scan to directly start the asset group scan. If the option is not enabled, you will need to add a credential. See Managing Credentials in USM Anywhere.
   Important: Credentials assigned directly to an asset have higher priority than those assigned to an asset group.

2. In the asset group details page, click Scan History in the table area to display the results of the scan.

   You can see the status of each scan and its details, which informs you if the scan has been successful or not. You can also click a line to expand the asset group row to check the individual asset results.

   Each asset group has a Scan Details link you can click to download a zip file containing the details of the recent scan. The link is only present for the most recent scan of each asset, and is available for one week after the scan has been run.

   Click Scan Details to download the zip file:

   • If you click Scan Details located in the asset group job row, the downloaded file will include one file per scanned asset.
   • If you click Scan Details located in the individual asset results, the downloaded file will include the information for just that asset.
   Note: You can see the vulnerabilities that the scan has found below the Vulnerabilities Events tab.