Drive your whole fleet from one console
Command and Control is authorized remote command dispatch for the scanner agents you run. Queue a scan, pull a session, change alert thresholds, or roll an update on any agent you choose, all from the portal, starting on the Business tier. Manage your whole fleet at once, with agent groups and bulk dispatch, on the MSP tier. It manages your own fleet, not anyone else's systems.
Agents dial out. Nothing dials in.
Every scanner agent opens no inbound port. It connects outbound over HTTPS, and any queued commands ride back on the heartbeat response. Your firewall never has to allow a connection toward the agent.
Commands queue with a priority and are delivered on the next heartbeat, up to twenty per cycle. Because the agent starts every connection, you can drop one behind the strictest outbound-only firewall and still command it.
What you can dispatch
Eight command types, each targeted at a single agent or a whole group. Command dispatch is included from the Business tier; targeting a whole group at once needs the MSP tier. Everything below ships today.
| Command | What it does |
|---|---|
| run scan | Launch a scan on any agent, on demand. |
| push session | Pull a finished session up to the portal. |
| update schedule | Add or adjust a scan schedule on an agent. |
| push config | Tune poll and heartbeat timing, log level, and alert thresholds. |
| set log level | Change log verbosity across the fleet. |
| restart | Restart the agent daemon. |
| shutdown | Stop the agent daemon. |
| update | Roll an agent to a new version. |
See every agent at a glance
The Fleet tab shows a live card for each agent: a status dot that flips to stale after ten minutes without a heartbeat, the version it is running, its uptime, its groups, and how many commands are pending. Open one to read its System Info, a ninety-day audit Timeline, and its command history.
- Live status at a ten-minute heartbeat threshold, refreshed every thirty seconds.
- Group agents by site or client and dispatch one command to all of them.
- Each agent keeps a stable identity across reboots and DHCP changes.
5
Total
4
Active
1
Stale
2
Groups
edge-scanner-01
nvd_89f6e23d · v4.6.0
38s ago
2 pendingbranch-pi-appliance
nvd_2c74a1e0 · v4.6.0
1m ago
idlelab-vm-legacy
nvd_5b1d90af · v4.5.0
2h ago
staleIllustration of the Fleet tab.
Built-in guardrails
Remote command execution is only as good as its limits. These are on by default and cannot be dispatched away.
300-second timeout
Any command running longer than five minutes is stopped and reported as failed, so a stuck job never hangs an agent.
Bounded, clean output
Captured output is truncated to 10 KB and terminal color codes are stripped at the source, so history stays readable.
Narrow config allowlist
Remote configuration is limited to eight daemon and alert settings. Scan targets, schedules, storage, and modules are never remotely editable.
Revoke and self-shutdown
Deregister an agent and its next heartbeat is refused; the daemon logs it and shuts itself down. Re-enable it later without losing its history.
Per-agent audit timeline
Every command, config change, and lifecycle event is recorded on a ninety-day timeline you can open per agent.
Authorized fleet only
The console manages the agents you deploy and register. It is not remote access to third-party systems, and it never scans a target you did not schedule.
Command dispatch starts on Business. Fleet-wide control ships with MSP.
The Business tier and up gets remote command dispatch to any one agent you choose. The MSP tier adds unlimited agents and sessions, agent groups, the audit log, and database health, alongside everything in Business. Pair it with the field appliance for drop-and-forget scanning you drive from the console.