Administration Guide

Credentials Reference

Reference for Audit Service credentials and site-owned cloud credentials.

Audit Service credentials

Common fields

Every credential, regardless of type, has:

Field Type Description
Title String, free text Display label that identifies the credential in the pool grid and audit logs.
Type Enum (one of seven, see below) Determines the rest of the form and how the secret is used.
Has password System-set indicator Lock icon in the grid when a secret is stored. The stored secret cannot be revealed back through the UI.

Per-type fields

Windows

For WMI and WinRM audits of Windows endpoints.

Field Required Description
Title yes —
Domain yes NetBIOS domain or . for local accounts.
Username yes Account name.
Password yes Stored encrypted at rest.

Linux and macOS

For SSH-based audits. A single type covers both OS families.

Field Required Description
Title yes —
Port yes (default 22) SSH port on the target.
Login yes Account name.
Password or Private key one of two Either an SSH password or a private key.
Use sudo toggle Run audit commands under sudo. On Linux, AlloyScan may still invoke sudo only for UUID collection when this option is off; the account must have the necessary sudoers permission.
Sudo password conditional Required whenever sudo prompts for a password, including for Linux UUID collection when Use sudo is off.

Hypervisor

For VMware ESXi. Other hypervisor values depend on the available credential types.

Field Required Description
Title yes —
Port yes Management port on the hypervisor.
Login yes —
Password or Private key one of two —
Use sudo toggle —

SNMP

Single type covering SNMP v1, v2c, and v3.

Field Applies to Description
Title all versions Display label for the credential record.
Community (SNMP v1/v2c) v1, v2c The SNMP community string.
Username (SNMP v3) v3 SNMPv3 username. Entering this value exposes the SNMPv3 authentication and privacy options.
Authentication protocol v3 One of No Authentication, Md5, Sha1, Sha256, Sha384, or Sha512.
Authentication phrase v3 Authentication secret for the selected protocol.
Privacy protocol v3 One of NoPrivacy, Des, Aes, Aes192, Aes256, or TripleDes.
Privacy phrase v3 Privacy secret for the selected protocol.

AWS

For cloud audits of AWS accounts.

Field Required Description
Title yes —
Access key ID yes AWS access key.
Secret access key yes Stored encrypted.

Azure

For cloud audits of Azure subscriptions.

Field Required Description
Title yes —
Tenant ID yes Azure AD tenant.
Client ID yes App registration client ID.
Client secret yes Stored encrypted.

Google

For cloud audits of Google Cloud projects.

Field Required Description
Title yes —
Project ID yes Target Google Cloud project.
Client email yes Service account email.
Private key or JSON key file one of two Service account credential material.

Cloud credentials

Cloud credentials belong to the current Site and are used by AlloyScan cloud worker. Each credential requires a Title and Provider.

Provider Required fields Notes
AWS Access key ID, Secret access key Key values are trimmed of whitespace.
Azure Tenant ID, Client ID, Client secret
Google Cloud Client email, Private key, Project ID Import from Google credential JSON.
Google Directory Client email, Private key, Delegated admin email JSON import fills service-account fields. Optional Customer ID defaults to my_customer.
Jamf User, Password The public HTTPS Jamf Pro base URL is configured in the segment.

Secrets are encrypted in AlloyScan and decrypted when needed for scans and audits. Editing preserves unchanged secret fields. The provider cannot be changed after creation. A credential cannot be deleted while referenced by a segment, discovered device, cloud work history, or audit data.

Constraints

  • Audit Service credential secrets remain in your local network. Cloud credential secrets are stored encrypted in AlloyScan.
  • The Has password column shows a lock icon when a secret is stored; the actual secret cannot be revealed back through the UI.
  • AlloyScan does not currently expose a per-credential Test or Validate button. Validate by triggering an ad-hoc audit.
  • Local execution uses the selected Audit Service's credential pool; cloud execution uses compatible, enabled site-owned cloud credentials.

RBAC

Action Site Administrator Site User
List credentials yes no (UI is admin-scoped)
Add credential yes no
Edit credential yes no
Delete credential yes no