User Guide
Credential Types Reference
Local execution uses an Audit Service's credentials pool. Each local credential is one of nine typed records. AlloyScan uses the credential type to authenticate to a matching target (Windows host, Linux host, hypervisor, SNMP device, or cloud or provider-specific source) during scan and audit.
Audit Service credential fields
| Type | Required fields | Notes |
|---|---|---|
| Windows | Title, Domain, Username, Password | Used for WMI and WinRM audits of Windows targets. |
| Linux and macOS | Title, Port (default 22), Login, Password or Private key, Use sudo, Sudo password | Single type covers both Linux and macOS targets via SSH. |
| Hypervisor | Title, Port, Login, Password or Private key, Use sudo | Used for hypervisor audit. VMware ESXi is the verified target. |
| SNMP | Title; for v1 / v2c: Community. For v3: Username (SNMP v3), Authentication protocol, Authentication phrase, Privacy protocol, Privacy phrase | SNMPv3 authentication and privacy options appear after you enter Username (SNMP v3). |
| AWS | Title, Access key ID, Secret access key | Used by AWS cloud Segments (Preview). |
| Azure | Title, Tenant ID, Client ID, Client secret | Used by Azure cloud Segments (Preview). |
| Google Cloud Platform | Title, Project ID, Client email, Private key (or JSON key file) | Used by Google Cloud Platform Segments (Preview). |
| Google Directory | Title, Client email, Delegated admin email, optional Customer ID, Private key, Confirm private key, Upload service account JSON | Used by Google Directory Chromebook Segments (Preview). Uploading a Google service account JSON file can autofill the client email and private key. |
| Jamf | Title, Jamf Pro server root URL, Login, Password, Confirm password | Used by Jamf Segments (Preview). |
Cloud credentials
For AlloyScan cloud worker, select compatible, enabled cloud credentials owned by the Site. They are stored encrypted in AlloyScan and are separate from the local-service pool. See Credentials Reference for provider fields and How to manage credentials for the management workflow.
Jamf cloud credentials contain User and Password; the public HTTPS Jamf Pro base URL belongs to the segment settings.
Constraints
- Audit Service credential secrets remain in your local network; cloud credential secrets are stored encrypted in AlloyScan.
- The stored secret cannot be revealed after save. The credential record shows only Has password or Not set. To rotate, enter a new value - the previous stored secret is overwritten.
- A credential's type is fixed at creation and is not editable after save.
- Each Audit Service has its own credentials pool. The credentials remain within your local network and are not shared across sites.