Search documentation

…atches and configuration changes do not take effect until reboot, and validation will correctly fail until then. Superseded patch: confirm the specific patch or update is still the…

…atus This article is a concise reference. A fully expanded guide for “Validation and Re-scan” is scheduled in the documentation roadmap; the steps below are accurate for the curren…

…atus This article is a concise reference. A fully expanded guide for “Validation Failed” is scheduled in the documentation roadmap; the steps below are accurate for the current pro…

Overview What AssurIQ is, the FIND → UNDERSTAND → FIX → VALIDATE → PROVE → REPORT loop, and how the product areas fit together. Documentation status This ar…

Overview The ten-step guided incident: mark, assess, revoke sessions, lock, retire, rotate, validate, evidence, controls, report. Documentation status This…

Purpose The FortiGate connector combines a read-only REST API administrator profile with SNMPv3 polling to collect firewall policy, VPN, firmware and interfac…

Overview A collector is the outbound-only agent that performs discovery, SNMP polling, configuration backup, log collection and local vulnerability checks for…

Purpose The Google Workspace connector collects user, group, 2-Step Verification and admin role evidence for organizations using Google as their identity prov…

Purpose This integration collects running configuration, interface, VLAN and CDP neighbor data from Cisco IOS and IOS-XE switches and routers using SNMPv3 for…

Purpose The SonicWall connector reads firmware, security service and firewall rule state from SonicOS appliances to assess management exposure and patch curre…

Purpose This integration uses the PAN-OS XML/REST API with a read-only administrator role to collect firewall policy, threat prevention, App-ID and firmware e…

Purpose The pfSense integration collects firewall rule, interface and package state from pfSense/pfSense Plus appliances using the pfSense REST API package or…

Purpose The Defender for Endpoint connector pulls device risk score, vulnerability, EDR alert and onboarding status via the Microsoft Graph Security API, feed…

Purpose The CrowdStrike Falcon connector uses the Falcon OAuth2 API with read-only scopes to collect host sensor health, detection and vulnerability exposure…

Purpose The SentinelOne connector reads agent health, threat and application inventory data through the SentinelOne Management Console API using a read-only s…

Purpose PSA connectors synchronize AssurIQ findings and remediation items into your ticketing system as tickets, and read back ticket status so remediation SL…

Purpose The Azure connector uses a read-only service principal to inventory subscriptions, resource groups, virtual machines, network security groups and publ…

Purpose The AWS connector assumes a read-only cross-account IAM role to inventory EC2 instances, security groups, IAM configuration and public exposure across…

Overview Each collector reports a heartbeat every 60 seconds. The control plane derives a single health state from the heartbeat history, reported metrics, cr…

Overview The v0.1 collector talks to three POST, JSON, snake_case endpoints under /api/v1/collectors. On deployments where the main site is access-restricted,…

…Traffic runs outbound from the collector over HTTPS with certificate validation. Common errors Code Title Fix AIQ-CRD-001 Credentials failing The Viewer account password or AP…

…platform tolerates up to 5 seconds of skew before heartbeat and mTLS validation are affected. NTP synchronization is strongly recommended on every collector host. Proxy environm…

Symptoms SNMP problems surface as missing or incomplete device detail: no interface list, no system name, stale firmware version, or a device that never leave…

Overview CVSS scores describe how severe a vulnerability could theoretically be if exploited under worst-case conditions. It says nothing about whether that v…

Overview The Windows package installs the AssurIQ collector as a native Windows service, supervised by the Service Control Manager and configured to start aut…

Overview The Linux package installs the collector as a systemd unit that starts on boot and restarts automatically if it exits unexpectedly. Linux ARM64 is…

Overview The Docker image runs the same collector binary as the native packages. Use host networking so the container can see local broadcast, ARP and multica…

Overview Where a site enforces all outbound traffic through a proxy, configure the collector to use it explicitly. Because the collector runs as a system serv…

Overview A collector never scans or probes a target that is not explicitly in scope. Scope is defined as a set of CIDR ranges, explicit exclusions, and hard-b…

Overview Retiring a collector is two separate actions: removing the software from the host, and revoking its credential in AssurIQ. Doing only the first leave…