Authenticated scan credentials

Store least-privilege authentication, verify target coverage, rotate secrets, and handle failed login.

Authenticated scans use an organization secret reference to inspect permitted host or application state. Credentials determine inspection coverage; successful network reachability does not imply successful authentication.

Create and validate a credentialCopy link

You need Administrator authority for the approved target scope and a dedicated assessment account on the target. Give that account the minimum read privileges required by the check profile.

1. At Assessments → Credentials → Add credential, choose the authentication type shown by the installed scanner, select permitted assets, and enter the secret through the protected field. After saving, the console shows metadata instead of plaintext.
2. Open Credential → Test and choose one authorized pilot target. Inspect authentication and privilege checks separately; a login can succeed while package inventory or configuration access fails.
3. At Assessments → Scans → Schedule → Authentication, attach the tested reference. Review lockout-sensitive accounts and test rate limits with the identity owner before scanning a broad fleet.
4. Start a pilot run and open Assessments → Runs → Run. Confirm the recorded credential version and authenticated check coverage match the profile. For a failed check, correct the reported target-account permissions or credential before another run.

Test results record the credential version and access level, excluding passwords and private keys. The scanner resolves the permitted secret for each run; it cannot reuse the reference on unrelated targets.

Failure and rotationCopy link

A failed login records authentication_failed; insufficient access records insufficient_privilege. Guard does not report those targets as fully authenticated. If unauthenticated fallback is enabled in the scan profile, the run labels its reduced coverage. Disable fallback when the task requires authenticated proof.

At Credential → Rotate, save the replacement and use Credential → Test on an authorized pilot target. Update Assessments → Scans → Schedule → Authentication to use it, then confirm a new run reports the expected authenticated coverage.

Existing runs retain their recorded credential version. Inspect them under Assessments → Runs before revoking the old account secret at the target system. Let authorized runs finish within the testing window, or open each run and choose Cancel. Wait for a terminal result before ending the old credential's access. Revoking it earlier can make those runs fail authentication.

Deletion and evidenceCopy link

A credential referenced by an enabled schedule cannot be deleted. Detach or replace it, disable affected work, revoke it upstream, then use Credential → Delete. Deleting a Guard reference does not disable an external account. Scan evidence and reports retain the reference ID and version, never its secret value.

Review credential use under Organization → Audit. If a scanner host is compromised, rotate the target credentials as well as its Guard identity and investigate retained evidence.