How Network Storage Scan Works

Network storage scans can be performed on mounted network share Targets via a Proxy Agent when the Node Agent is installed on a host other than the Target host.

When the Proxy Agent receives instructions from the Master Server to scan a network storage location, the Proxy Agent copies the latest version of the scanning engine to the Proxy host. The Proxy Agent then establishes a secure connection to the Target host and copies data from the Target host to the Proxy host.

Scanning Network Storage Locations transmits scanned data over your network, increasing network load and your data footprint. Scan network storage locations as local storage and local memory where possible. For more information, refer to the Perform Agentless Scan section.

The scanning engine is then executed locally on the Proxy host. It scans the data copied from the network storage Target host and sends aggregated results to the Proxy Agent, which in turn relays the results to the Master Server. Data from the Target host is not stored or transmitted to the Master Server. Only a small amount of contextual data for found matches is sent back to the Master Server for reporting purposes.

Once the scan completes, the Proxy Agent deletes the data from the Proxy host and closes the connection.

Enterprise Recon 2.7.0 Network Storage Scan architecture consisting of Master Server, Proxy Agent and Target host.

Try to locate the Proxy Agent and network storage Targets in the same VLAN. Moving data across VLANs increases your data footprint.

To start a network storage scan, refer to the Scan Network Storage Locations section.