Online Help

Audit Service Reference

The Audit Service is a Windows-hosted component that performs agentless discovery and audit on reachable devices inside your network. Each site can host one or more Audit Services; each service holds its own credentials pool and is assignable to one or many Segments.

Fields

Field Type Values Default Description
Name string system-generated host + id — Hostname-based identifier shown in the services grid.
Client ID string system-generated — OAuth client identity used by the service to authenticate to the instance.
Host name string machine name — The Windows host running the service.
IP address string IPv4 / IPv6 — Single IP address recorded for the service host.
Registration date datetime — set on first heartbeat When the service first registered with the instance.
Last active datetime — — Most recent heartbeat.
Version string semver — Audit Service binary version.
Updater version string semver — Updater binary version.
Expiration date datetime — — Date at which the service is deleted if it remains inactive after being scheduled for deletion.

Constraints

  • Each Audit Service has a single recorded IP address. Re-installation on a different host creates a new service record.
  • One Audit Service can serve many Segments.
  • An Audit Service holds a credentials pool of up to seven types: Windows, Linux and macOS, Hypervisor, SNMP, AWS, Azure, Google.
  • Credentials are encrypted at rest on the service host and never leave the local network.
  • An Audit Service may be flagged Outdated when its version lags behind the instance frontend. Outdated services continue to run — this is a soft flag, not a hard stop.
  • Site setting Inactivity period (default 30 days) controls how long a service can be silent before being scheduled for deletion. After the same period elapses without a heartbeat, the service is deleted.

States

State Description Transitions
Active Service has sent a recent heartbeat. -> Inactive when no heartbeat for the inactivity period. -> ScheduledForDeletion when an Administrator clicks Schedule for deletion.
Outdated Orthogonal flag set when the service version lags the frontend. The service remains usable. Cleared when the service binary is updated.
Inactive No heartbeat past the inactivity period. -> Active if a heartbeat resumes. -> ScheduledForDeletion automatically after the configured inactivity period.
ScheduledForDeletion The service is queued for deletion at its Expiration date. -> SelfUninstalled if the service comes online during the window. -> Deleted when the Expiration date passes while the service remains offline.