Operational command view
Current state at a glance: inventory posture, what needs review, scan recency, and the live activity stream. Use Executive mode for the same signals as roll-ups and trend charts. Next steps: Assets for drill-down, Scan history for job health, Reports for evidence, System health for services.
Executive overview
Roll-up deltas, recent actions, and trend charts for the window above—same data as operator mode, framed for a quick read.
How to read this summary
Risk snapshot
Counts across assets, findings, and scans. Charts below follow the trend window.
Trends and distributions
Top risk items
Triage queue from the executive window — follow rows into host or device detail.
| IP | Device | Hostname | Type | Top CVE | CVSS | Findings |
|---|---|---|---|---|---|---|
| Loading… | ||||||
Operations overview
Single current-state strip: posture totals, attention cues (unclassified, open CVEs), scan freshness, then asset mix. Normal throughput metrics stay visually quiet; risk and review tiles read first.
Top vulnerable assets
Priority rows for open findings — use as the triage short list before wider inventory search.
| IP | Device | Hostname | Type | Vendor | Top CVE | CVSS | Findings |
|---|---|---|---|---|---|---|---|
| Loading… | |||||||
Recent activity
Event timeline — scans, imports, and admin actions; refresh after you change configuration or queue work.
Assets
Live registry of scanned hosts. Triage with search, type, severity, lifecycle, and optional inventory scope, AI, or Zabbix filters — active constraints show in the summary above the table. Row selection powers bulk scope actions. Use Details / IP for host context; Reports for job-scoped evidence; Enrichment for Zabbix match workflows.
Search & filters
Primary query row, then optional AI / Zabbix / scope panels. Exports and Clear filters apply to the current result set.
Inventory list
Dense table — sort columns for risk, recency, or scope. Selection on this page ties to the bulk bar.
No rows often means tight filters — try Clear filters or widen search. A genuinely empty inventory is uncommon after successful scans.
| IP address | Device | Hostname | Type | Life | Vendor / model | Open ports | CVEs | CVSS | Zbx | Scope | Last seen | Edit | |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Loading assets… | |||||||||||||
Scopes are named organization buckets for scan and inventory context. Job scope (scan_jobs.scope_id) is saved when work is queued and powers historical reporting; inventory scope (assets.scope_id) groups current assets and posture. Those dimensions are related by name but independent by storage, so changing asset tags does not rewrite prior jobs.
Create & edit scope
Use + New scope to add catalog entries with name, optional description, environment, and CIDR hints. Use Edit per row to update metadata safely. Scope assignment happens from Scan, Schedules, Assets bulk actions, or Enrichment workflows; this page manages the scope catalog and impact visibility.
Scope inventory
Dense list of configured scopes. Counts show live assets, finished jobs, and linked schedules; use these to spot populated vs dormant scopes before changes.
| Name | Description | Environment | Assets | Jobs | Schedules | Actions |
|---|---|---|---|---|---|---|
| Loading scopes… | ||||||
Operator controls
Edit updates labels/metadata without changing historical evidence. Delete clears dependent references after confirmation and shows impact counts first (assets unscoped, job/schedule scope links cleared, related mappings removed). For assignment workflows, use Assets bulk scope tools, Scan/Schedules scope selectors, or Enrichment scope apply.
Devices
A device is a stable device_id — the logical identity SurveyTrace uses to group IP-based assets that belong to the same system (shared MAC / correlation rules). Assets remain one row per address; open a device to see linked IPs, hostnames, and recency. Use Assets to browse all addresses for a device; use Merge in the side panel only after operator review (confirmed, audited).
Search & sort
Find devices by id, normalized MAC, label, or any linked IP/hostname. Sort highlights busy identities (# assets, last activity) or MAC order.
Device inventory
Dense list — click ID for detail and linked addresses; Assets jumps to the Assets tab filtered to this device_id. Multi-address devices get a light emphasis.
| ID | MAC (norm) | # Assets | IP sample | Last activity | Created | |
|---|---|---|---|---|---|---|
| Loading… | ||||||
Vulnerabilities
CVE-centric review and triage: sort and filter by severity, asset type, resolution, age, and detection confidence. Each row ties a finding to an asset (IP/hostname); use IP filters or row clicks to narrow. Evidence columns summarize match method; open host detail for full context. Actions (when permitted): mark resolved after remediation or accept risk with audit — exports respect the same filters as the table.
Triage controls
Combine search, IP, severity, asset class, open vs resolved, publication year, confidence, and sort. CSV/JSON exports use the current filter set.
Findings
Dense table — severity chips and triage scores surface risk; high/critical rows are subtly highlighted. Use pagination to walk the full filtered set.
| CVE ID | Asset IP | Hostname | Type | Description | CVSS | Triage | Match | Published | Actions |
|---|---|---|---|---|---|---|---|---|---|
| Loading vulnerabilities… | |||||||||
Review actions
Resolve when remediation is verified (finding leaves the open list; audited). Accept risk documents acceptance and suppresses recurring open alerts for that finding while it remains accepted — use with governance alignment. Readers see status only. If the table is empty, confirm whether filters exclude everything vs. no data yet (see message in the findings grid).
Vulnerability Dashboard
Operator-focused risk posture at a glance: severity counts, highest-risk assets, aging criticals, common vulnerable packages, recent findings, suppressions, and analyst overrides. All data is locally computed from advisory correlation — bounded, offline, no external enrichment.
Summary
Highest-risk assets
Top assets ordered by weighted risk score (critical=40, high=10, medium=3, low=1). Capped at 25 rows.
| Asset | Risk band | Score | Critical | High | Total | Oldest |
|---|---|---|---|---|---|---|
| Loading… | ||||||
Oldest critical/high findings
Critical and high-severity findings open more than 30 days without resolution.
| Advisory | Severity | Asset | CVSS | Age (days) | First seen |
|---|---|---|---|---|---|
| Loading… | |||||
Most common vulnerable packages
Packages affecting the most assets across the environment.
| Package | Ecosystem | Affected assets | Findings |
|---|---|---|---|
| Loading… | |||
Recent findings
Most recently detected open findings (latest 50). Use pagination for more.
| Advisory | Severity | Asset | CVSS | First seen |
|---|---|---|---|---|
| Loading… | ||||
Suppressed findings
Active suppressions (accepted risk or deferred).
| Advisory | Severity | Asset | Reason | Expires |
|---|---|---|---|---|
| Loading… | ||||
Analyst overrides
Findings where analysts have overridden the model priority.
| Advisory | Severity | Asset | Priority | Changed by | When |
|---|---|---|---|---|---|
| Loading… | |||||
Remediation status
Operator remediation workflow tracking: overdue, verification failures, and recently resolved.
Scan launch workspace
What you’re scanning — CIDR targets, exclusions, optional label and reporting scope. Profile sets port depth and intensity. Discovery and scan steps control how hosts are found and what runs on each. Enrichment applies your configured sources after collection (per-job overrides below). After you queue, live counters and the job table link forward to Scan history for full status.
Targets & profile
Define addresses in scope, what to skip, and how aggressively to scan. Rate limits and discovery mode apply to this job only.
Scan steps & enrichment
Turn scan steps on or off for this run. Enrichment uses sources from the Enrichment tab; override inclusions here without changing saved defaults.
Queue, progress & job list
Send the job to the collector queue. Counters reflect the active run when applicable; the table below mirrors queued work on this page — open Scan history for the full log.
Queue and past runs:
Queue & execution log
Live queue
Jobs waiting or executing now — progress, priority, and start time.
History & outcomes
Finished and failed runs in time order — filter by view, source, label, target, or job id.
| # | Job / target | Status | Profile | Hosts | AI | Duration | Completed | Actions |
|---|---|---|---|---|---|---|---|---|
| Loading scan history… | ||||||||
Reports & Analysis
Evidence workspace: pick report mode first — job scope is historical scan evidence (finished runs, snapshots, drift, trends, baselines). Inventory scope is current operational posture (live assets and open findings by tag) — not scan history. Same scope names; different lineage.
- Job scope completed scans → drift, trends, baseline, exports
- Inventory scope live posture → summary only; switch to job mode for history
Scope & mode
Controls below set whether outputs reflect which finished jobs or which live inventory bucket. Generate analysis after the scope matches your question.
Job scope filters completed scan jobs by scan_jobs.scope_id.
Inventory scope filters current assets by assets.scope_id and summarizes open findings for those assets.
Job mode: each named option shows assets · done jobs (live inventory tag vs finished scans whose scan_jobs.scope_id was set when queued).
Job scope vs asset tags (technical)
scan_jobs.scope_id matches the tag stored when the job was queued.Dropdown labels: assets = live inventory tag (
assets.scope_id); done = finished scans with this scan_jobs.scope_id. Charts filter by the job count, not the asset count.
Historical scan evidence
Latest job snapshot, drift vs a reference, and bounded job history for the selected job scope. If sections stay empty, the filter may have no completed jobs yet — or you are in the wrong mode.
No data? Confirm Job scope reports and a bucket with finished scans. For live posture only, use Inventory scope reports above — drift and trends stay job-only.
At a glance
Summary for the latest completed scan that matches your report scope, plus a quick compliance readout when available.
What “Live” and the compliance line mean
Snapshot drift
Automatic drift compares the latest finished scan in your filter to a reference scan (saved baseline, prior job in the same scope, or a compatible prior for unscoped jobs). Read-only.
How automatic drift picks a reference scan
Unscoped latest scans: the prior reference is chosen only when a compatibility signal matches (same schedule, batch, target CIDR, or label prefix); unrelated legacy scans are not auto-paired.
Named / Unscoped filter: baseline rules for that bucket, then a compatible prior when unscoped.
Trends
Each point is one finished job in the current report scope (last N jobs). Not real-time.
More about snapshot trends
Advanced operator tools
Manual analysis tools
Explicit compares, compliance detail, baseline management, and saved artifacts. Compare and Load compliance are read-only for all roles. Set baseline and artifact Details need scan editor or admin.
Compare any two completed scans
Pick any two finished jobs for a custom snapshot diff (same style as automatic drift above). Use when you need a specific pair or automatic drift is not available.
Compliance detail
Full rule text for one completed job. Optional: evaluate extra rules against the saved baseline. The At a glance section shows a quick pass/fail for the latest job only.
Baseline for this report scope
Which scan is used as the reference for automatic drift and optional compliance-vs-baseline checks. Status is read-only; scan editors can set a baseline when a named scope or Unscoped only is selected (not All scopes).
Saved report artifacts
Identity & cadence
Profile & performance
Scan steps
Network enrichment
Timezone
Execution & reporting
Missed runs & catch-up
| # | Status | Label | Hosts | Queued | Finished |
|---|---|---|---|---|---|
| Loading… | |||||
Execution record
Scan detail
Compare
Progress & status
Summary
Full summary snapshot (collapsed by default)
Assets discovered
| IP | Hostname | Category | Ports |
|---|---|---|---|
| Loading assets… | |||
Logs / raw details
Show scan log tail & raw fields
Actions
Recurring scans are optional — ad-hoc runs from Scan control work without any row here. When you do use schedules, each definition has its own target, profile, cron cadence, and timezone; the scheduler computes next run while the entry is enabled and not paused. Pause freezes cadence without deleting; turning Cron enabled off in the editor marks the definition dormant. Collectors and reporting scopes attach per schedule so jobs queue to the right agent and inherit context.
Create & edit
Open + New schedule or the edit (✎) control on a row. The dialog keeps target CIDR, cron (and presets), profile, discovery mode, rate limits, scan steps, enrichment sources, timezone, collector vs master, optional reporting scope, exclusions, missed-run policy, and cron enabled — same fields as before, grouped for quicker scanning.
Schedule inventory
Each row is one automation: ON / OFF is the cron switch; Paused (when ON) stops advancing until you Resume. Scan next / last run, profile, scope, and collector columns summarize what will execute.
| Name | Target | Scope | Profile | Cron | Collector | Missed runs | Next run | Last run | Last result | On | |
|---|---|---|---|---|---|---|---|---|---|---|---|
| Loading… | |||||||||||
Operator controls
Hist opens run history; Pause / Resume toggles frozen cadence; ▶ Run now queues an immediate job (confirm if prompted). Delete (✕) removes the schedule permanently — confirm before proceeding. Row shading highlights active (enabled, not paused), paused, or off schedules.
Optional remote scan agents: the master queues work and ingests results; each collector registers with an install token, polls for assigned jobs, runs work locally (better ARP/mDNS visibility on-site), and uploads chunked artifacts back for async ingest, CVE correlation, and enrichment. Master-only installs never need a collector row here. Generate or rotate install tokens under Settings (admin).
Fleet status & registration
Live counts and one row per registered collector: name/site context, allowed CIDR ranges, schedule assignments, heartbeat, last IP, and chunk queue health (pending / failed).
| ID | Name | Status | Last seen | IP | Pending | Failed | |
|---|---|---|---|---|---|---|---|
| Loading… | |||||||
Operator controls
Per row: Set ranges constrains target CIDRs for that collector; Manage in schedules ties recurring work to a collector; Rotate token invalidates old install credentials (confirm, then update the agent); Revoke permanently removes the collector and its tokens — use only when decommissioning. Job assignment and chunk return health show in Pending / Failed; use Refresh and System health for broader service state.
Audit log
Operational event record for operator and system activity across SurveyTrace. Use this stream to answer what changed, who acted, and when, with source IP context and severity labels for investigation.
Filters & review controls
Filter by free-text and level, refresh the stream, and toggle auto-scroll for live review. Controls are read-only and preserve backend audit semantics.
Audit event stream
Dense chronological entries. Timestamp + level indicate recency and severity; message body includes actor/IP context when emitted by the source subsystem.
Event details & no-data guidance
Message text is shown inline for fast triage. If the stream is empty, either no entries have been recorded yet or current filters return no matches — clear filters or refresh before concluding no activity.
External context & operator workflows
Configure network enrichment sources (SNMP, files, APIs, integrations) for scan-time context. Optionally connect Zabbix: sync pulls host data into SurveyTrace; review validates candidate matches; apply writes only after explicit confirmation. Output push (when enabled) is separate from sync — it sends state out to monitoring, not into the cache.
- Sources what runs during scans
- Sync pull into SurveyTrace
- Review matches & rules before apply
- Apply confirmed identity / scope only
- Push optional outbound integration
Configure sources
Enable and tune connectors used as network enrichment on the Scan tab and in scheduled jobs.
Types you can add; status reflects readiness on this server.
How enrichment works
They add hostnames, MACs, VLANs, and other context the scanner may not see on its own — especially across routers or for hosts that barely respond to probes.
Integrations — vendor APIs and dashboards you already use can return many clients in one call when that system already knows them.
SNMP — read-only walks on routers or switches (ARP tables, bridge data) as a vendor-neutral option.
Files and logs — DHCP leases, DNS or firewall exports, and similar paths pull names and clients from your own records.
Sync external context (Zabbix)
Connector status, last sync, cache freshness, and manual pull. Run sync now refreshes the in-app host cache — not an output push.
Loading…
Operational status console for services, scheduler, storage, database files, and integration freshness (feeds, Zabbix, collectors). All checks are read-only — use Refresh for a new snapshot. Follow Needs attention when anything requires operator follow-up; raw detail stays under Advanced diagnostics.
Open this tab or choose Refresh to load the latest health snapshot.
Change alerts
Review stream for observed state changes across scans and inventory. Alerts capture what changed, affected assets, detection time, and lifecycle signals (new, reopened, mitigated) so operators can triage expected vs suspicious drift quickly.
Filters & review controls
Refresh updates the open-change view. Dismiss all is available for scan editors/admins and hides open rows without altering underlying scan/finding data.
Change alert stream
Dense table for timestamp, change type, affected asset/job, and evidence summary. Rows with unresolved CVE changes are visually emphasized for review.
| When | Type | Target | Detail | Actions |
|---|---|---|---|---|
| Loading… | ||||
Review & resolution actions
Dismissing hides an item from this list only. For new CVE and CVE reopened rows, Accept risk acknowledges the finding (same as Vulnerabilities), dismisses related open alerts, and suppresses repeats until risk is unaccepted.
Access control
Security administration workspace for local users, role assignment, OIDC/SSO, and emergency breakglass access. UI permissions are role-aware: viewer, scan editor, and admin capabilities are enforced server-side and reflected throughout the product.
Users and roles
Account state, role, MFA status, and sensitive actions are managed here. Disabled users stay in the list for auditability.
Daily admin tasks
Advanced security and SSO settings
| User | Name | Role | MFA | Disabled | Actions | |
|---|---|---|---|---|---|---|
| Loading… | ||||||
| User | Failed attempts | Last failed (UTC) | Locked until (UTC) | IP |
|---|---|---|---|---|
| Loading… | ||||
| When (UTC) | Action | Actor | Target | IP |
|---|---|---|---|---|
| Loading… | ||||
Sign-in methods
Authentication mode, OIDC configuration, and SSO role-source mapping are managed in Daily admin tasks above. Keep breakglass configured so emergency local login exists if IdP auth is unavailable.
Security-sensitive controls
Password policy, OIDC secret fields, breakglass username, MFA reset, password reset, role changes, and user deletion are trust-affecting actions. Use these controls deliberately; confirmations and server-side authorization remain enforced.
Integrations
Connector workspace for inbound pull consumers and outbound push delivery targets. Pull integrations expose SurveyTrace data endpoints (Grafana, Prometheus/Alloy, scripted inputs) with per-integration tokens; push integrations deliver canonical events outward (webhook, syslog, Splunk HEC, Loki) when you run Test / Sample. Secrets and token hashes remain server-side and are never returned raw.
Configured integrations
Two inventories below: Push destinations (outbound delivery) and Pull/API consumers (inbound reads into external dashboards/tools). Enabled state, endpoint summary, auth/token state, and recency are shown per row.
Quick start (Grafana, Prometheus / Alloy, Splunk)
/api/integrations_dashboard.php (?view=trends|events|metrics|compliance), report summary, and optional JSON metrics/events. Or use Grafana Infinity / report summary pull for dashboard + report summary only./api/integrations_metrics.php. Auth: Authorization: Bearer <token>./api/integrations_events.php?since=…&format=jsonl. Auth: Authorization: Bearer <token>. See integrations/starter/splunk_surveytrace/.Destination URLs or syslog host:port. Use Test / Sample to send a canonical reporting event.
| Name | Type | Mode | On | Destination | Auth | Last test | Actions |
|---|---|---|---|---|---|---|---|
| Loading… | |||||||
Per-row Generate / Rotate token. After rotation, copy the plaintext once — it will not be shown again.
| Name | Type | Mode | On | API paths | Token | Last used | Actions |
|---|---|---|---|---|---|---|---|
| Loading… | |||||||
Add integration workflow
Create connectors with name, type, enabled state, endpoint/host settings, and optional secret token fields. Pull/API types hide destination secret inputs and show endpoint-specific token usage help. Edit uses the existing modal with the same save and secret-clear behavior.
Delivery & diagnostics
Use row-level Last test and Last used fields to detect stale/failing connectors quickly. For push connectors, run Test / Sample after edits; for pull connectors, rotate tokens if compromised and verify client-side bearer usage.
Transport only — pulls hosts, interfaces, groups, tags, and problems into local tables. Sync runs in the background; the API token is never returned from the server. Match review, scope mapping, manual link/unlink, and apply workflows are on the Enrichment tab (Zabbix tools panel, after sync).
Sender server is where zabbix_sender connects on TCP (default port 10051). This may differ from the API URL if the API is behind a proxy or tunnel.
Use the exact Host name from Zabbix (Configuration → Hosts). This is not the sender TCP address.
SurveyTrace sends health and security summary metrics to Zabbix. No alerts are created by default.
Tokens & security
Pull APIs: use Authorization: Bearer <token> in production. Legacy ?token= still works but is deprecated (responses include a Warning header).
Starter files: integrations/starter/ (see README).
Integrations are optional. Common first deployments: Grafana pull dashboards, Prometheus/Alloy metrics pull, Splunk webhook/HEC or scripted pull, syslog forwarding, and custom webhooks for external dashboards/automation.
Settings
System configuration workspace for app/service behavior, feeds, AI automation, and maintenance controls. Authentication and user lifecycle policy live in Access control; this tab focuses on runtime/system options and operational tuning.
Configuration groups
Each card keeps its own save/test actions. Use section tabs to focus on one operational area at a time.
Core application behavior, security defaults, session policy, and role-aware access controls.
External systems, collectors, feeds, API access, and data exchange settings.
Credential profiles, bounded check jobs, execution history, and authenticated evidence controls. Credentialed checks run as separate jobs on the master credential-check worker. Optional per-job recurring schedules are driven by surveytrace-scheduler (not scan_schedules).
Operational lifecycle tools for retention, backup/restore validation, secret rewrap, and stuck-worker recovery.
Low-frequency controls, AI behavior, and experimental or diagnostic configuration.
Reference material, build information, category definitions, and operational documentation links.
full_tcp safe-port scans (finite port union on high-latency paths).
Example: 10000,15672,11434
When enabled, viewer accounts can no longer call the System Health or inventory export APIs—only scan editor and admin roles. Default is off (unchanged from prior releases).
System Health — Background jobs (preview): warn when the count of worker_jobs in failed status is at least this number.
Use 0 to turn off that hint (failed counts still appear). Default 1 matches prior behavior.
Compact posture from profiles/jobs plus credentialed-run and worker health snapshots.
Define reusable credential metadata per transport using structured fields (plus optional advanced JSON). Principals never contain passwords or keys — those are stored as encrypted envelopes. The encryption key is set in /etc/surveytrace/surveytrace.env (readable by the surveytrace user, not the web pool); the web UI invokes daemon/cred_secret_ops_cli.php via a narrow sudo rule to encrypt secrets and run handshake tests. Without a working helper you can still save profile metadata, but storing secrets, handshake tests, and credentialed runs that need decryption fail safely. Handshake tests are available for SSH and SNMPv3; WinRM handshake is deferred.
Encryption status: —
| Name | Transport | Principal | Scope | On | Secret | Last test | |
|---|---|---|---|---|---|---|---|
| — | |||||||
- Save profile
- Set secret
- Enter target host/IP
- Run handshake
- Read result panel below the test controls in the modal
Credentialed checks run on the master worker (surveytrace-credential-check-worker) — not on remote collectors. They are not triggered by normal scans or scan_schedules; create a job, optionally enable a recurring schedule (processed by surveytrace-scheduler via credential_schedule_tick.php), and use Run now or wait for the next schedule_next_run_at. Each launch enqueues worker_jobs (job_type=credentialed_check). Implemented plugins: ssh.linux.os_release@1.0.0, ssh.linux.package_inventory@1.0.0, and snmpv3.device_identity@1.0.0 with bounded outputs/artifacts and trusted-data observation writes. Intentionally not implemented here: arbitrary commands, remediation, WinRM execution, CVE/finding fusion, or custom SNMP walk/SET behavior.
| Name | Profile | Mode | On | Schedule | Next run | Last run | |
|---|---|---|---|---|---|---|---|
| — | |||||||
Run list shows bounded previews only in Detail (no full package dumps). Stored credential_check_results / artifact metadata grow with history; automatic TTL is not enabled. From the server install tree: sudo -u surveytrace php /opt/surveytrace/scripts/prune_credential_runtime_history.php --dry-run (default), then --apply --days=N --keep-runs=N after review — preserves active runs and non-terminal jobs per script policy. Broader retention: prune_operational_history.php (optional --include-runs). See docs/wiki/deployment.md and docs/wiki/credentialed-checks-integration.md.
| Run | Job | Profile | Plugins | Status | Trigger | Targets | Duration | Worker job | Started | Finished | |
|---|---|---|---|---|---|---|---|---|---|---|---|
| — | |||||||||||
One server job and one log per run in data/feed_sync_result.json. The sections that follow describe each feed; you can also run NVD, OUI, WebFP, and CVE intel in a single job at the bottom of this card.
sync_nvd.py or use the button below.
NVD_API_KEY is set in the server environment, it overrides the saved key.
To replace a saved key, remove it first, then paste the new one.
The browser returns immediately. Incremental NVD often takes several minutes (10+ is normal for large NIST batches, or longer without an API key). Cancel stops after the current fetch. If you killed a process on the host and the UI is stuck, Reset sync lock. If the network drops, the job retries; run again when the link is back.
WebFP last sync: — · rules: 0
Runs NVD, then OUI, then WebFP, then CVE intel in order. Expect a long run—NVD alone is often many minutes; CVE intel may take additional time on first run. The sections above let you refresh each feed on its own.
Shows the most recent run (whichever set of buttons you used). Sync all appends NVD, OUI, WebFP, and CVE intel sections in one file. The same log loads after a page reload.
PHP + SQLite + Python scanner daemon
Data stored in data/surveytrace.db
View release notes
| srv | Server (Linux, Windows Server, macOS in server roles) |
| ws | Workstation / laptop (Windows, macOS, ChromeOS) and mobile-style endpoints (iOS, iPadOS, Android) when fingerprinting indicates a client device |
| net | Network gear (switch, router, firewall) |
| iot | IoT device |
| ot | OT / ICS (PLC, SCADA, HMI) |
| voi | VoIP phone / PBX |
| prn | Printer / MFP |
| hv | Hypervisor (VMware ESXi / vSphere / vCenter, Proxmox VE, Hyper-V) |
daemon/backup_db.sh.
--apply operation.
php scripts/prune_operational_history.php --older-than-days=90
php scripts/recover_stale_worker_jobs.php --older-than-minutes=60
These tools are CLI-only in this release. No browser-triggered maintenance actions are exposed. Runbook · Troubleshooting