Skip to content

Agent schedule and resource use

The Nanitor agent is designed with these principles in mind:

  • Low memory footprint
  • No third-party dependencies
  • Low CPU overhead
  • Low network footprint. Payload is compressed JSON and we only send configuration and vulnerability changes when there has been a change.
  • Run tasks that complete quickly

The tasks that the Nanitor agent performs are the following:

  • Every five minutes sends a heartbeat to the server.
  • Every 12 hours checks vulnerability information (OVAL scan).
  • Every hour checks the system configuration.
  • Every 6 hours check and sends system inventory to the server.
  • Every 2 hours checks patch information.
  • Every 2 hours checks firewall and AV status.
  • Every 30 minutes checks whether a new agent version is available.
  • Every 20 minutes scans for PII, when PII scanning is enabled.
  • Every 90 minutes (domain information) and every hour (users) runs Active Directory discovery, on agents that perform it.

For a table that also covers Network discovery, see How often do the agent and Network discovery run?

When Nanitor publishes new or changed vulnerability content, the agent picks it up within minutes via the 5-minute heartbeat and immediately performs a vulnerability check-in for that content, rather than waiting for the next scheduled scan. A vulnerability check-in is a vulnerability scan on the asset followed by sending the results to the Nanitor server.

The 12-hour vulnerability scan timer restarts whenever the agent starts, so a device that is often powered off may never reach it. To cover this, the agent checks at startup whether its last successful vulnerability scan is older than 12 hours. If it is, the agent runs a catch-up scan 10 minutes after startup, which gives the system time to finish booting. If the catch-up scan fails, the agent retries once a minute, up to 5 attempts in total.

The server also requests a new vulnerability check-in for agent-collected assets that were active within the last 24 hours but whose last vulnerability check-in is more than 24 hours old. It repeats a request for the same asset at most once per 24 hours. The agent then runs the scan as soon as it receives the request.

When you install the Nanitor agent you will see two services running: 1. nanitor-agent.exe (nanitor-agent on MacOS) is the Nanitor agent runner that checks on the most recent version of the Nanitor agent. It will download and install the most recent version of the Nanitor agent. 2. nanitor-agent-bin.exe (nanitor-agent-bin on MacOS) is the actual Nanitor agent that does the checks on the installed machine and reports to the Nanitor server its findings. This service is upgrading itself to the newest version by request from the Nanitor server.

The agent only communicates with the server instance it registered to during installation and only via HTTPS using TCP443. All communication is outbound and initiated by the agent. The agent will not respond to any connection attempts it did not initiate.