Endpoints & Scans
Adding servers to monitoring, how scanning works, and how to read scan results.
An endpoint is one server being monitored, identified by its IP address. Add one with its IP (or hostname, which is resolved when you save) and a nickname so you recognize it later.
When scans happen
- Automatically: your servers are checked continuously in the background; you never have to schedule anything.
- On demand: every endpoint has a *Scan now* button. Manual scans have a short cooldown between runs, shown on the page.
Reading a scan result
| Field | Meaning |
|---|---|
| Open ports | Every port on the server that answered from the public internet. |
| New ports | Ports open now that were not open in the previous scan, worth a look. |
| Closed ports | Ports that were open before and are closed now. |
| Detected services | What appears to be running (web server, database, mail…), inferred from ports and banners. |
An open port is not automatically a problem. A web server is *supposed* to answer on 443. Ports you expect belong in Allowed Ports; everything else raises an issue.