Discovery scope and safety
CIDRs, exclusions, blocked targets, concurrency and maintenance windows: how scan scope is defined and enforced server-side.
Overview
A collector never scans or probes a target that is not explicitly in scope. Scope is defined as a set of CIDR ranges, explicit exclusions, and hard-blocked targets, together with schedule and concurrency limits — and it is enforced on the AssurIQ control plane, not just trusted to the collector's local configuration.
Elements of a scope
| Element | Purpose |
|---|---|
| CIDR ranges | The subnets that are in scope for discovery and scanning |
| Exclusions | Specific addresses or smaller ranges carved out of an included CIDR |
| Blocked targets | Hosts that must never be probed even if technically inside an included range (e.g., fragile OT devices) |
| Max concurrency | Caps simultaneous probes to avoid overwhelming fragile network gear |
| Maintenance windows | Restricts credentialed or intrusive scan types to approved time windows |
| Credentialed vs uncredentialed | Whether the scan authenticates to targets for deeper checks or stays network-only |
| Discovery-only | Limits a scope to passive/lightweight discovery with no vulnerability probing |
Scope expansion requires approval
Widening a scope — adding a CIDR, removing an exclusion, or lifting the discovery-only restriction — requires explicit approval before it takes effect. This prevents a compromised or misconfigured job definition from silently reaching further into a network than intended.
- 1Propose the changeEdit the scope and submit the expansion for approval.
- 2ReviewAn authorized approver reviews the new ranges and rationale.
- 3Approve or rejectOnce approved, the new scope becomes effective for the next scheduled or on-demand job.
Protecting fragile devices
OT/ICS equipment, older SNMP-capable devices, and some embedded management interfaces can be destabilized by aggressive scanning. Use blocked targets and conservative concurrency for these, and prefer discovery-only or SNMP-based enrichment over active vulnerability probing where uptime is critical.
Job lifecycle
Every scan or discovery run moves through a fixed sequence of states, each visible from the Jobs view.
| State | Meaning |
|---|---|
| Queued | Accepted and waiting for a collector slot |
| Dispatched | Sent to the assigned collector |
| Running | Actively probing in-scope targets |
| Uploading | Sending results back to the control plane |
| Processing | Control plane is parsing and reconciling results |
| Completed | Finished with no errors |
| Partial | Finished, but one or more modules failed |
| Failed | Did not complete |
| Cancelled | Stopped before completion, by a user or a maintenance window boundary |
Troubleshooting
- AIQ-SCN-001Scan not runningA scheduled scan did not start.
- AIQ-SCN-002Scan target outside authorized scopeA target was rejected because it falls outside the site's approved CIDRs, or matches an exclusion or blocked target.
- AIQ-SCN-003Scan job failedThe scan job did not complete.
- AIQ-SCN-004Scan job partialThe job completed but one or more modules failed to finish.