Yes; customers using Alert Logic Essentials, Professional, or Enterprise in the Managed Detection & Response platform can start and stop vulnerability scans on demand.
Note: Discovery scans cannot be started and stopped on demand. Agent-based scanning can be disabled for a deployment to prevent future hosts scan executions.
Start a Scan on Demand
There are two ways you can start a scan on demand:
- Scan a specific asset or multiple assets within a deployment
Within each deployment, you can define multiple scan schedules to scan specific assets within the scope of protection at different times. When creating or editing one of these scan schedules, a Scan once option is available and allows you to scan the selected assets right away or at a defined time in the future.
For detailed instructions on accessing and using the Scan Schedules page, refer to our Manage Scan Schedules documentation.
- Scan a specific asset located using the Topology page
To scan a specific host, simply click the host on the Topology page, and then in the slideout panel, click Actions, and then click SCAN NOW.
When you click SCAN NOW, Alert Logic will execute a network scan for the host right away or as soon as possible, outside the normal schedule and ignoring any exclusions. If agent-based scanning is enabled for the target host, Alert Logic will start a host scan execution and network scan at the same time and consolidate the vulnerability results after the network scan completes.
For more detailed instructions and more information on the Topology page, refer to our Topology documentation.
Stop a Scan On Demand
When necessary, you can also choose to stop a network scan that is in progress directly on the Scan Schedules page. When a network scan is in progress, the “Scan In Progress” text displays in the scan list next to the scan schedule name. To stop the network scan, simply click STOP THIS SCAN, and then click STOP THIS SCAN again on the confirmation window that displays.
The network scan is stopped and “Incomplete Scan” displays next to the scan name. The scan will start again at the next scheduled time. If you want to stop future scans, you can also deactivate the scan or delete the scan schedule if it is no longer needed.
For more information on accessing and using the Scan Schedules page, including stopping and deactivating scans, refer to our Manage Scan Schedules documentation.