How often do the agent and Network discovery run?
This article lists how often the Nanitor agent runs each task and how often Network discovery updates. These are the defaults as of Nanitor 7.3.0.
In short: agents check in every 5 minutes, a new device is typically shown as rogue within 5 to 25 minutes, and the detailed checks run every 1 to 12 hours.
Agent schedule
| Task | Default interval | Notes |
|---|---|---|
| Check-in (heartbeat) | 5 minutes | Tells the server that the agent is alive. The same check-in also reports open ports, logged-in users, the last boot time and Network discovery data. |
| Configuration (benchmark) check | 1 hour | |
| Patch information | 2 hours | |
| Firewall and antivirus status | 2 hours | |
| System inventory | 6 hours | |
| Vulnerability check (OVAL) | 12 hours | Also runs right away when Nanitor publishes new or changed vulnerability content. |
| PII scan | 20 minutes | See PII issues. |
| Agent upgrade check | 30 minutes | |
| Active Directory discovery | 90 minutes for domain information, 1 hour for users | Only on agents that perform Active Directory discovery. |
A check can also be started on demand. See How do I force a re-check of my configuration?.
Network discovery schedule
Network discovery works in two steps:
- Agents report what they see. On every 5-minute check-in, the agent reads its own ARP table (the devices it has recently communicated with) and routing table (the networks it can reach). It sends them to the server when they have changed since the last report, and at least every 90 minutes even when nothing has changed. Agents collect and report this data regardless of the Network discovery setting, and the server discards it for organizations and networks where discovery is off. Collector-monitored Cisco (IOS, ASA and Nexus), Check Point Gaia and Junos devices also contribute their ARP tables, on the collector's own schedule.
- The server turns the reports into rogue devices. By default, the server processes the received reports every 15 minutes. It creates or updates rogue devices only for organizations where Network discovery is enabled, and only for networks where Network discovery is turned on. Reports from all other networks are ignored.
A new device is therefore typically shown as rogue within 5 to 25 minutes. It changes the ARP table, so it is reported on the next check-in and does not wait for the 90-minute report. The range adds the 5-minute check-in to the server's 15-minute cycle (which can be up to 2 minutes longer) and the processing time. This is a typical value, not a guarantee of detection, and it applies only if:
- Network discovery is enabled for the organization and turned on for the network that the device is on.
- The network is already known to Nanitor. Reports for a network that Nanitor has not yet registered are ignored.
- An agent (or a supported collector-monitored network device) on the same network has seen the device. A device that has not communicated recently may not be in the ARP table.
By default, a rogue device that is no longer detected is archived after 7 days and then shown as Expired. This can be changed in the archival policy. See Asset device lifecycle states and Nanitor Archival Policy.
See Network discovery for how to enable it.