Help Center

Step-by-step guides for every ArcScan feature. FAQ →

Where Things Live
The sidebar is organised as a security pipeline: six groups plus Work
HomeOverview dashboard, Ask ArcScan (natural-language Q&A over your security graph), and Insights, including the Executive dashboard.
InventoryAdd environment, assets, applications, devices, network topology, CMDB sync, and the Discovery Engine (sweeps, deep probes, agents).
FindingsEverything discovered wrong: Vulnerabilities, cloud & infrastructure Posture, Drift, Attack Paths, Data Security (DSPM), Enterprise Apps, Threat Intel, Zero Trust.
RemediateRemediation wizards & runs, Agentic Actions, automations, Workflow Builder, Terminal.
Comply & ReportCompliance frameworks, continuous ATO, evidence locker, audit log, Trust Center, scan comparison, usage analytics.
Settings & WorkspaceIntegrations, Scan Setup (new/scheduled scans, connect cloud), Product Deployments, Arc Tripwire, Team & Access, Vault, and the Marketplace flyout that holds Quantum Arc and Arc Redactor.
WorkBoards, the built-in work OS for running remediation sprints.
Fastest route anywhere: press Ctrl+K / ⌘K to open the command palette and type the page, finding, or asset you're looking for.
Local / Dev Setup
Run ArcScan on your machine for development or testing
1
Clone the repo
git clone https://github.com/arcusautomate/AnsibleAuditor.git cd AnsibleAuditor
2
Create a virtual environment
python3 -m venv venv source venv/bin/activate pip install -r requirements.txt -c constraints.txt
3
Set environment variables
Create a .env file (or export in your shell):
export DJANGO_SECRET_KEY=$(python -c "import secrets; print(secrets.token_urlsafe(50))") export ANTHROPIC_API_KEY=sk-ant-your-key-here # or OPENAI_API_KEY export DEBUG=True
4
Run migrations and start
python manage.py migrate python manage.py createsuperuser python manage.py runserver
Open http://localhost:8000 in your browser.
Tip: For background tasks (scheduled scans, async reports), also run Celery: celery -A playbookscan worker --loglevel=info
Your First Scan
Run an Ansible playbook audit in under 60 seconds
1
Open the Scan page
Open Settings & Workspace → Scan Setup → New Scan in the sidebar, press ⚡ New Scan from the dashboard, or hit Ctrl+K / ⌘K and type "scan".
2
Paste or upload your playbook
Paste YAML directly into the editor, or click Upload File to select a .yml or .yaml file. You can also drag and drop.
3
Click Scan
ArcScan sends the content to your configured AI provider. The audit typically completes in 5–20 seconds.
4
Review your report
Your score (0–100) and grade (A–F) appear at the top. Scroll through findings sorted by severity, Critical, Warning, Info, Pass.
No API key yet? Go to Settings and add your Anthropic or OpenAI key first. See Add an AI API key.
Add an AI API Key
Connect Anthropic, OpenAI, Gemini, DeepSeek, or Nvidia
1
Open Settings
Navigate to Settings → Settings & API Keys.
2
Choose your provider
Select from Anthropic OpenAI Gemini DeepSeek Nvidia. Anthropic Claude is recommended for best audit quality.
3
Paste your API key
Get your key from the provider's dashboard (e.g. console.anthropic.com → API Keys). Paste it into the API Key field and click Save.
4
Test it
Run a quick scan, if the key is valid you'll see a report within seconds. Keys are encrypted at rest and never shared.
Custom endpoint? Enterprise users can enter a custom base URL (e.g. Azure OpenAI, local Ollama) in the Custom Endpoint field below the key.
Account & Profile
Email preferences, report delivery, and weekly digest
1
Go to Settings
Settings → Settings & API Keys.
2
Set your report email
Enter the email address to receive scan reports and alerts. Defaults to your account email if left blank.
3
Enable weekly digest
Toggle Weekly security digest to receive a Monday morning summary: scan count, posture score, open critical findings. Sent only if you had scans in the past 30 days.
4
Theme
Click any colour swatch in Settings → Theme (or via the top-right Settings menu) to switch colour scheme. Saved to your browser.
Enable Two-Factor Auth
TOTP app, SMS, or email verification
1
Open 2FA setup
Settings → Two-Factor Auth.
2
Choose a method
Authenticator App (recommended, Google Authenticator, Authy, 1Password) · SMS · Email OTP
3
Scan QR code (TOTP)
Open your authenticator app, scan the QR code shown, then enter the 6-digit code to confirm. Save your backup codes in a secure location.
4
Confirm & activate
Enter the code and click Verify. 2FA is now active, you'll be challenged on every new login.
Lost your device? Use a backup code to sign in, then reconfigure 2FA. Contact your org admin if backup codes are also lost.
Scan a Playbook
Full walkthrough of the playbook audit tab
1
Paste, upload, or pull from storage
The Audit tab accepts: raw YAML paste · file upload · cloud storage files (Drive, GitHub, GitLab). Switch tabs to choose your input method.
2
Select a scan type
Choose Ansible Playbook, Kubernetes, Dockerfile, GitHub Actions, etc., each uses a purpose-built AI prompt.
3
Click Scan & watch the stream
Results stream in real time. The AI checks: hardcoded secrets · missing no_log · non-idempotent shell/command · deprecated modules · state:latest · broad become · missing tags · Jinja2 issues · and 10+ more.
4
Review the score card
Score 0–100 · Grade A–F · Critical/Warning/Info/Pass counts · Executive summary · Per-finding detail with line hints and fix snippets.
Finding IDs follow the format ANSI-001 and map to ansible-lint rule IDs where applicable. Click a finding to expand the full fix snippet.
Reading a Report
Score, grades, findings, compliance, threat model, and SBOM
Score (0–100)Weighted deduction per severity. 100 = no issues found.
Grade (A–F)A≥90 · B≥75 · C≥60 · D≥40 · F<40
CriticalSecurity risks that must be fixed before production.
WarningBest-practice gaps that will cause reliability issues.
InfoNon-blocking suggestions for improvement.
PassChecks your playbook passed, confirms coverage.

Compliance tab: per-framework scoring (CIS, NIST, SOC 2, FedRAMP) with control-level pass/fail breakdowns. Available on Pro+.
Threat Model tab: AI-generated attack vectors with MITRE ATT&CK references and likelihood/impact ratings.
SBOM: Software bill of materials listing Ansible collections, roles, and packages. Download as CycloneDX JSON.
Dep Graph: Visual map of play → role → task dependencies. Click Expand to render.
Blast Radius: Estimated host count, target groups, and environment impact of the playbook.

Auto-Fix Findings
Let Claude patch your playbook and open a remediation PR
1
Open a report with findings
Navigate to any report with Critical or Warning findings.
2
Click ⚡ Auto-Fix
ArcScan sends all findings + the original YAML to Claude with a remediation prompt. The AI returns a fully patched playbook with # FIXED: comments on each change.
3
Review the diff
The diff view highlights every added/removed line in green/red. Scroll through before accepting.
4
Download or open a PR
Click Download Fixed to get the patched YAML, or click Open PR (requires GitHub/GitLab token in Settings) to automatically push a remediation branch and open a pull request.
Pro tip: Run a second scan on the fixed file to verify your score improved. Use ⇄ Compare to view the diff between original and fixed risks.
Multi-File / ZIP Scan
Audit an entire Ansible project or role directory
1
Zip your project
Create a .zip of your Ansible directory. Recommended structure: roles/, playbooks/, inventory/. Max 10MB.
2
Switch to Multi-file tab
On the Scan page, click the Multi-file / Zip Scan tab and upload your archive.
3
Review results per file
Each YAML file is scanned individually. The results page shows a consolidated score plus per-file breakdowns with individual finding lists.
Schedule Recurring Scans
Automatically re-scan playbooks daily or weekly
1
Open Scheduled Scans
Settings & Workspace → Scan Setup → Scheduled Scans → New Schedule.
2
Set frequency and source
Choose Daily or Weekly. Attach a stored playbook from the library, or paste inline YAML.
3
Configure notifications
Enable email notification on new critical findings. Optionally attach a webhook (Slack, Teams) to post results automatically.
4
Regression detection
If the score drops more than 10 points between runs, ArcScan flags a regression and sends an alert regardless of your notification settings.
Compare Two Reports
See which findings were fixed, introduced, or persisted
1
From a report
Open any report and click the ⇄ Compare button. The compare page loads with that report pre-selected as Report A.
2
From the Compare page
Go to Comply & Report → Compare Scans, then select two reports from the dropdowns.
3
Read the delta
Fixed findings were resolved. New findings appeared. Persisted findings remain unchanged. Score delta shows improvement or regression.
Connect a Cloud Account
AWS, Azure, and GCP credential setup
1
Open Cloud Connect
Settings & Workspace → Scan Setup → Connect Cloud.
2
Select your provider
AWS: Enter Access Key ID and Secret Key. Minimum IAM permissions: ReadOnlyAccess or a custom policy with EC2/S3/RDS/IAM Describe permissions.
Azure: Service principal credentials: Tenant ID, Client ID, Client Secret, Subscription ID. Assign Reader role.
GCP: Service account JSON key. Assign Viewer role at the project level.
3
Give it a label and save
Credentials are encrypted with Fernet symmetric encryption. They never appear in logs or AI prompts.
4
Run your first inventory pull
Go to Findings → Posture → Cloud Posture and click Refresh to pull live resource data from your account.
Least privilege: ArcScan only needs read access. Never grant write or admin permissions to the scan credential.
Security Posture Scan
CIS-aligned deterministic checks with AI remediation
1
Open Security Posture
Findings → Posture → Infrastructure.
2
Select credential and scan
Choose your cloud account from the dropdown and click Run Scan. Deterministic checks complete in seconds, no AI call, no cost.
3
Review findings
Each finding shows: Severity · CIS control reference · Resource affected · Why it's a risk · Remediation steps · Suggested Ansible module.
4
Remediate a failed check
Every failed check carries a Remediate Now action, a dry-run-first remediation run scoped to that check. See Remediate Now. You can also click Generate Remediation to have the AI write a playbook targeting all critical findings (requires an AI API key).
Scheduled posture scans: set a daily/weekly/monthly recurrence per cloud credential on the Connect Cloud form, due credentials are scanned automatically in the background.
Deploy Agents & Probes
Provision Arc Probe, Quantum Arc, or Arc Redactor into your own cloud
1
Open Product Deployments
Settings & Workspace → Product Deployments → Deploy, then pick a product: Arc Probe (discovery + remediation agent), Quantum Arc (post-quantum crypto discovery appliance), Arc Redactor (PII sanitization container).
2
Pick a target credential
Choose an existing cloud credential or create and test one inline in the wizard, the connection is validated before you can proceed.
3
Review and launch
The wizard generates a Terraform deployment spec (instance size, network, tags) for your review, then provisions it into your cloud account. Progress and logs stream on the deployment detail page.
4
Verify the agent checked in
Deployed Arc Probes appear under Inventory → Discovery Engine → Agents with a heartbeat. Deep probes and package inventory (which feed the CVE dashboard) run from Discovery Engine → Deep Probes.
Teardown: every deployment has a one-click teardown on the same page that destroys the Terraform-managed resources, nothing is left running in your account.
Agent security: Arc Probe connects outbound-only over mTLS with a per-agent client certificate, no inbound ports are opened into your network.
Host preparation (SSH deep-probe accounts): read-only discovery only needs an account that can SSH in (key or password credential from the Vault). Privileged actions, CVE patching and the one-click Reboot host, additionally run with Ansible become as that account, so give it privilege escalation: either passwordless sudo (enables patching and reboot), or a minimal reboot-only grant in /etc/sudoers.d/arcscan: arcprobe ALL=(root) NOPASSWD: /usr/sbin/shutdown (replace arcprobe with your probe username). Password-credential accounts use the same password for sudo automatically. Arc Probe agents installed with the default systemd unit run as root and need no extra setup.
Cost Anomaly Detection
Spot unexpected spend spikes in your cloud accounts
1
Connect a cloud account
Cost data requires a connected account. See Connect a Cloud Account.
2
Open Cost Anomalies
Findings → Posture → Cost Analysis.
3
Review flagged services
ArcScan compares current spend against your 30-day rolling baseline. Services spending 2× or more above baseline are flagged with the delta amount.
Drift Detection
Detect when live infrastructure deviates from your baseline
1
Create a baseline
Run an inventory pull, then click Lock as Baseline on the Cloud Inventory page. This snapshots the current resource state.
2
Schedule drift checks
Go to Findings → Drift and enable daily drift comparison. ArcScan compares the live inventory against your locked baseline.
3
Receive drift alerts
New, removed, or changed resources trigger an email + webhook alert with a diff of what changed.
Application Tagging
Map cloud resources to business applications and generate Terraform tags
1
Open a cloud snapshot
Go to Findings → Posture → Cloud Posture and click into any snapshot.
2
Select resources
Use the checkboxes next to EC2 instances, S3 buckets, RDS databases, security groups, etc. The selection bar shows how many are selected.
3
Tag to an application
Click Tag Application. Select an existing application or create a new one (name, owner, environment, criticality, data classification). Click Apply Tags.
4
Generate Terraform (optional)
Click Generate Terraform Tags to produce HCL that applies arcscan:* tags to the selected resources in your real cloud infrastructure. Download the .tf file and run terraform init && terraform apply.
Persistence: Application mappings persist across scans. Once tagged, the association holds until you remove it, even if you re-scan the cloud account.
ITSM Application-Resource Sync
Push app-resource mappings as dependencies to ServiceNow, Jira, and FreshService
When you tag resources to an application, you can optionally push that mapping as dependencies/relationships to your configured ITSM tools.
1
Configure your ITSM integration
Set up at least one integration: ServiceNow (with CMDB push enabled), Jira, or FreshService.
2
Tag resources to an application
In a cloud snapshot, select resources and click Tag Application. When integrations are configured, a Sync to ITSM section appears with checkboxes.
3
Check your targets and apply
Check ServiceNow CMDB, Jira, and/or FreshService, then click Apply Tags. ArcScan tags locally and syncs to the selected tools.
What gets created per tool:
ServiceNow
Application becomes a Business Service CI (cmdb_ci_service). Each resource CI is linked via cmdb_rel_ci "Depends on" relationships.
Jira
Application becomes an Epic. Each tagged resource becomes a Sub-task linked to the Epic.
FreshService
Application becomes an Asset. Each resource becomes a linked asset via the FreshService relationships API.
Idempotent: Re-syncing the same application reuses the existing ITSM objects (same Epic, same Business Service CI) rather than creating duplicates. New resources are added as new relationships.
CVE Review
Work the vulnerability dashboard: real hits on real assets
1
Open the CVE Dashboard
Findings → Vulnerabilities → CVE Dashboard. Rows are vulnerability hits, a CVE matched against a package actually installed on one of your assets (from deep probes, agents, or image scans), enriched from NVD, OSV, GHSA, and distro advisories.
2
Prioritise
Filter by severity, KEV (CISA Known Exploited), and EPSS. Click a CVE for full detail: affected assets, fixed versions, and advisory links. Overnight rescans and KEV flips raise bell + Slack/Teams alerts automatically.
3
Fix: or let triage draft the plan
Click Remediate Now on any row (see Remediate Now), or click Run Triage to have the AI score and cluster new hits by fix (same package upgrade across hosts = one cluster) into a plan where every step still requires your approval.
4
Export
Download the org-wide SBOM (CycloneDX or SPDX JSON, with open vulnerabilities embedded) or a VEX statement set from the dashboard filter bar, or stream findings to your SIEM in CEF format via the v2 API. The reachable flag comes from the exposure analyzer and drives the VEX disposition.
Remediate Now
One-click, dry-run-first remediation from any CVE, posture check, finding, or asset
1
Start from the finding
Click Remediate Now wherever you see it: a CVE row (single or bulk), a failed posture check, an enterprise-scanner finding, or an asset page (e.g. close an open port). ArcScan builds the remediation playbook for that exact target.
2
Dry-run first
Runs default to dry-run: the playbook executes in check mode and you review the planned changes plus a blast-radius score (how many hosts/resources the change touches) before anything is applied.
3
Apply or schedule
Choose apply now or schedule to defer into a maintenance window. Execution routes through your Arc Probe agent or AWX/AAP. If your org requires change management, the run first opens a ServiceNow change and waits for approval, see Change management.
4
Track runs
Every run, manual, scheduled, or automated, leaves a receipt at Remediate → Remediation → Runs with status, diff/stdout, and the gate decisions that applied. Guided pick-a-finding wizards live on the Remediation dashboard.
Trust tiers: verified playbooks (deterministic, registry- and syntax-checked) can auto-apply under an explicit policy; AI-generated playbooks are always dry-run + human review. Policy-as-code guardrails and org maintenance windows gate unattended automation, manual Remediate Now is never blocked, only warned.
Change Management (ITSM Gating)
Route automation through a ServiceNow change → approval → run
1
Connect ServiceNow
Configure the ServiceNow integration first, change requests are created in your instance.
2
Opt yourself in (personal)
In Settings, enable Change management. Your automation runs will now open a ServiceNow change request and wait for approval before executing.
3
Enforce it org-wide (Manager)
A user with the Manager role can enforce change management for the whole organization from Settings & Workspace → Team & Access → Team Management. The mandate wins: it applies to every member and locks their personal toggle on, members cannot opt out of an enforced org policy.
4
How a governed run flows
Automation dispatch → ServiceNow change request created → change approved in ServiceNow → ArcScan executes the run (Arc Probe / AWX) → result recorded on the run receipt.
Fail-closed: an unapproved or rejected change never reaches your infrastructure. If the approval check cannot be verified, the run does not execute.
Boards (Work OS)
Run remediation work as a team without leaving ArcScan
1
Open Boards
Work → Boards. Create a board and add groups (swimlanes) to organise items, e.g. This sprint / Backlog.
2
Add items: CVEs auto-populate
Add free-form items, or add a CVE item: the row auto-populates severity, affected assets, and remediation context from your live vulnerability data.
3
Assign and customise
Assign org members to items, and add columns (status, dates, text, numbers) to match how your team tracks work.
4
Switch views
Toggle between Table and Kanban: same items, drag cards across status lanes in kanban.
Generate a Playbook
Describe what you need: Claude writes the YAML
1
Open Generate tab
Generate → Generate Playbook.
2
Describe your task
Write a plain-English description. Examples: "Install and configure Nginx on RHEL 9 with TLS" or "Create a user, set a password with Ansible Vault, and add to sudoers".
3
Configure options
Set target OS, inventory hosts group, whether to use become, and style (minimal/verbose/best-practice). Best-practice mode adds handlers, tags, and no_log automatically.
4
Generate → scan immediately
Click Scan Generated to immediately audit the output. Generated playbooks typically score A or B, any gaps are shown as findings.
Generate Terraform
Three ways to produce production-ready HCL
ArcScan offers three Terraform generation modes:
A
From Cloud Inventory
Pull your live AWS/Azure/GCP inventory, then click Generate Terraform. ArcScan reverse-engineers your existing infrastructure into HCL modules with proper variable files and outputs.
B
From Description
Describe the infrastructure you want: "3-tier VPC with public/private subnets, ALB, 2 EC2 web servers, RDS MySQL". Claude generates complete, provider-versioned HCL.
C
Import tfstate
Upload a terraform.tfstate file. ArcScan reconstructs the source HCL and audits it for security issues simultaneously.
Access all three modes at Generate → Terraform Dashboard.
CI/CD Workflow Builder
Generate pipeline configs with ArcScan quality gates
1
Open Workflow Builder
Generate → Workflow Builder.
2
Choose your CI platform
GitHub Actions GitLab CI Jenkins Azure DevOps AWX/AAP
3
Set quality gate threshold
Enter a minimum score (e.g. 75). The generated pipeline will call the ArcScan API, parse the score, and fail the build if it falls below the threshold.
4
Copy and commit
Copy the generated YAML/Jenkinsfile to your repo. Add ARCSCAN_API_KEY as a CI secret using your token from Settings → API Keys.
PR Auto-Scan
Automatically audit playbooks when a PR is opened on GitHub or GitLab
1
Add your SCM token
Go to Settings → Settings & API Keys. Paste your GitHub Personal Access Token (needs repo scope) or GitLab token (needs api scope).
2
Set a webhook secret (recommended)
Add GITHUB_WEBHOOK_SECRET (or GITLAB_WEBHOOK_SECRET) to your server environment. This is used to verify that webhook payloads come from GitHub/GitLab.
3
Configure the webhook in GitHub
In your GitHub repo: Settings → Webhooks → Add webhook.
Payload URL: https://your-domain/webhooks/github/
Content type: application/json
Secret: your GITHUB_WEBHOOK_SECRET
Events: check Pull requests only.
4
Open a PR
When a PR adds or modifies .yml / .yaml files, ArcScan audits each one (up to 5) and posts a score table comment directly on the PR.
GitLab: Same flow but use /webhooks/gitlab/ as the payload URL and select Merge request events.
ServiceNow Integration
Auto-create incidents, push CIs to CMDB, and sync app dependencies
1
Configure connection
Integrations → ServiceNow. Enter your instance URL (e.g. company.service-now.com), username, and password or OAuth token.
2
Set assignment group and urgency
Map ArcScan severity levels to ServiceNow urgency (1–3). Choose the default assignment group for auto-created incidents.
3
Auto-create incidents from findings
When a scan produces Critical findings, ArcScan can automatically open a ServiceNow incident with the finding detail, remediation steps, and a link to the ArcScan report.
4
CMDB CI push
Enable Push to CMDB in your ServiceNow config. ArcScan creates or updates Configuration Items for each cloud resource using a configurable CMDB table and correlation field.
5
Application dependency sync
When tagging resources to a business application, check ServiceNow CMDB in the Sync to ITSM section. ArcScan creates a Business Service CI for the app and cmdb_rel_ci relationships linking each resource. See ITSM Application-Resource Sync.
Slack & Teams Alerts
Real-time security event notifications
1
Create an Incoming Webhook
Slack: api.slack.com/apps → Your App → Incoming Webhooks → Add New Webhook. Copy the Webhook URL.
Teams: In your Teams channel → Connectors → Incoming Webhook → Configure. Copy the URL.
2
Add in ArcScan
Integrations → SIEM Webhooks → New Webhook. Set provider to Slack or Microsoft Teams, paste the webhook URL, and choose which events to send.
3
Test it
Click Test next to the webhook. A test message appears in your Slack/Teams channel within seconds.
Available events: new scan completed · critical finding detected · account locked · scheduled scan regression · cloud drift alert.
REST API
Programmatic access to scans, reports, and findings
1
Generate an API token
Settings → API Keys → Create Token. Copy the token, it's only shown once.
2
Authenticate
Pass your token in every request header: X-API-Key: arcscan_<your_token>
3
Submit a scan
curl -X POST https://your-domain/api/v1/scan/ \ -H "X-API-Key: arcscan_YOUR_TOKEN" \ -H "Content-Type: application/json" \ -d '{"name": "deploy.yml", "content": "---\n- hosts: all\n tasks:\n ..."}'
4
Retrieve reports
curl https://your-domain/api/v1/reports/ \ -H "X-API-Key: arcscan_YOUR_TOKEN"
Full API reference at Generate → API Docs. The same token works for the MCP server your AI agents connect to.
CVE Watch
Get email alerts when new CVEs match your packages or roles
1
Open CVE Watch
Settings → CVE Watch (or search for it in Smart Search).
2
Add packages to watch
Enter the package/role name and select the ecosystem: Ansible Galaxy PyPI npm Generic keyword. Set your severity threshold (High+ recommended).
3
Receive alerts
ArcScan checks the NVD CVE 2.0 API weekly. When a new CVE is published matching your package at or above your threshold, you'll receive an email with the CVE ID, CVSS score, description, and NVD link.
Speed up checks: Admins can add an NVD_API_KEY environment variable for higher NVD API rate limits.
Credential Store
Store secrets that auto-inject into generated playbooks
1
Open the Vault
Settings → Vault → Credential Store.
2
Add a secret
Click New Secret. Enter a name (used as a Jinja2 variable, e.g. db_password), value, and optional description. Secrets are encrypted with Fernet and never appear in risks.
3
Auto-injection
When generating playbooks or running audits, ArcScan substitutes vault references () with the actual encrypted Ansible Vault values in the output. The raw secret never touches the AI provider.
4
Reveal or rotate
Click the eye icon to temporarily reveal a secret for verification. Click Edit to rotate the value, the audit log records the change timestamp.
External Vaults
Connect HashiCorp Vault, AWS Secrets Manager, or Azure Key Vault
1
Open External Vaults
Settings → Vault → External Vaults.
2
Choose your vault type
HashiCorp Vault: KV v2, Token or AppRole auth.
AWS Secrets Manager: IAM role or access keys.
Azure Key Vault: Service principal + vault URL.
3
Test and save
Click Test Connection. ArcScan does a read-only lookup to verify credentials. Connection details are stored encrypted.
4
Reference in playbooks
Use the external vault path syntax when generating playbooks. ArcScan resolves paths at generation time and wraps them in !vault tags for Ansible Vault compatibility.
Create an Organisation
Share reports, credentials, and scan history with your team
1
Go to Team Workspaces
Settings → Team Workspaces → Create Organisation.
2
Set name and invite members
Enter a display name and optional branding. Invite members by email, they receive an invitation link and are added with Member role by default.
3
Share an org-level API key
Create a shared API key for the org so all members can run scans under the same account without sharing individual keys.
4
View org reports
On the Dashboard, the Team Reports tab shows all scans by org members. Owners and admins can see all reports; members see their own.
Roles & Permissions
Owner → Admin → Member → Viewer hierarchy
OwnerFull access. Can delete org, promote/demote members, manage billing and SSO.
AdminSame as Owner minus billing and org deletion. Can invite/remove members.
MemberCan scan, generate, view all org reports, manage their own vault secrets.
ViewerRead-only access to org reports and posture dashboards. Cannot scan or generate.
On top of the org roles above, every member also has a functional role that shapes the sidebar and gates write actions server-side: Business Engineer Senior Engineer Manager Auditor. Engineers and above can scan and generate; Senior Engineers unlock remediation and integrations; Managers manage the team, enforce org policies (like change management), and see everything; Auditors get read access to compliance evidence and the audit log.
Managers assign functional roles in Settings & Workspace → Team & Access → Team Management; org roles are managed in Team Workspaces by clicking the role badge next to a member's name. Role changes take effect immediately.
AWX / AAP Setup
Browse and scan playbooks from Ansible Automation Platform
1
Get your AWX credentials
In AWX/AAP, go to Users → your user → Tokens and create a Personal Access Token with Read scope. Copy the token. Alternatively, use a username + password.
2
Configure in ArcScan
Go to Integrations → AWX / AAP Settings. Enter:
  • Instance URL: e.g. https://awx.company.com
  • Token: the PAT you created (or username + password)
  • Verify SSL: uncheck only for self-signed certs
3
Test connection
Click Test Connection. You should see the AWX version. Then click Sync Job Templates to pull in your templates.
4
Browse playbooks
Go to Integrations → AAP Playbooks to browse all projects and playbooks. Click any playbook to preview it, then Scan to run an audit.
Score gating: Set Min Score to Run (e.g. 60) to block AWX job templates from running if their playbook scores below the threshold.
GitHub Integration
Browse repos, auto-scan PRs, create remediation PRs
1
Connect via OAuth
Go to Integrations → Cloud Storage and click Connect GitHub. Authorize ArcScan to access your repositories.
2
Browse and scan
On the Scan page, click the GitHub button in the import row. Browse repos → navigate folders → select a YAML file → Import. Content loads into the editor for scanning.
3
PR auto-scan (optional)
Set up a webhook to auto-scan playbooks on every pull request:
Repo → Settings → Webhooks → Add webhook Payload URL: https://your-arcscan.com/webhooks/github/ Content type: application/json Secret: (set GITHUB_WEBHOOK_SECRET in .env) Events: Pull requests
4
Remediation PRs
After scanning, click Create Remediation PR on any report. ArcScan auto-fixes findings and opens a PR against your repo.
GitLab & Bitbucket work the same way, connect via Cloud Storage, browse repos, set up webhooks at /webhooks/gitlab/.
Azure DevOps
Browse repos, scan playbooks, auto-create work items from findings
1
Create a Personal Access Token
In Azure DevOps: User Settings → Personal Access Tokens → New Token. Grant these scopes:
  • Code: Read (to browse repos and files)
  • Work Items: Read & Write (for auto-creating bugs)
2
Configure in ArcScan
Go to Integrations → Azure DevOps. Enter:
  • Organization URL: https://dev.azure.com/your-org
  • PAT Token: paste the token (encrypted at rest)
  • Project: the project name to browse
3
Browse and scan
On the Scan page, click Azure DevOps → select a repo → navigate to your playbook → Import.
Auto work items: Enable Auto-create work items to automatically file Bugs in Azure DevOps for critical/high findings.
Wiz Integration
Import Wiz issues and auto-generate remediation playbooks
1
Get Wiz API credentials
In Wiz: Settings → Service Accounts → Create. Grant read:issues and read:resources scopes. Copy the Client ID and Client Secret.
2
Configure in ArcScan
Go to Integrations → Wiz → Settings. Enter your Client ID, Client Secret, and the Wiz API URL (e.g. https://api.us1.app.wiz.io).
3
Run a scan
Go to Integrations → Wiz and click Scan. ArcScan pulls your Wiz issues, groups them, and generates remediation playbooks using AI.
4
Auto-remediate
Review the generated playbooks, download them, or push directly as a PR to your SCM. Schedule recurring scans for continuous remediation.
Terraform Cloud
Link Terraform Cloud for IaC governance and deployment gating
1
Create a TFC API token
In Terraform Cloud: User Settings → Tokens → Create an API token. Copy the token.
2
Configure in ArcScan
Go to Integrations → Terraform Cloud. Enter your Organization name and API Token.
3
Scan Terraform configs
Go to Generate → Terraform to scan HCL files, or import Terraform state for drift detection.
Cloud Storage
Connect Google Drive, OneDrive, Dropbox, GitHub, GitLab, or Bitbucket
1
Go to Cloud Storage
Integrations → Cloud Storage shows all available providers with connect buttons.
2
Connect a provider
Click Connect next to the provider. You'll be redirected to their OAuth screen to authorize ArcScan. For Git providers (GitHub, GitLab, Bitbucket), grant read repository scope.
3
Browse and scan files
Once connected, the provider appears on the Scan page import row. Click it to browse your repos/files and import playbooks directly into the scanner.
Auto-sync: Set up folder sync to automatically scan playbooks when they change in a specific folder or repo path.
Self-hosted: For Docker deployments, you need OAuth client credentials. Register an OAuth app with each provider and set the client ID/secret in your .env: GITHUB_STORAGE_CLIENT_ID, GITHUB_STORAGE_CLIENT_SECRET, etc.
Jira Integration
Auto-create issues from findings and sync application Epics
1
Create an API token
Go to Atlassian API tokens and create a new token. Copy it.
2
Configure in ArcScan
Go to Integrations → Jira. Enter:
  • Jira URL: https://your-org.atlassian.net
  • Email: your Atlassian email
  • API Token: paste the token
  • Project Key: e.g. SEC or OPS
3
Test and enable
Click Test Connection, then enable Auto-create issues to file tickets for critical/high findings automatically.
4
Application Epic sync
When tagging cloud resources to an application, check Jira in the Sync to ITSM section. ArcScan creates an Epic for the application with Sub-tasks for each tagged resource. See ITSM Application-Resource Sync.
FreshService Integration
Auto-create tickets/changes and sync application assets
1
Get your API key
In FreshService: Profile → API Key. Copy the key.
2
Configure in ArcScan
Go to Integrations → FreshService. Enter your domain (e.g. mycompany.freshservice.com) and API Key. Optionally set agent, group, and department.
3
Auto-create tickets or changes
Choose Ticket or Change as the record type. ArcScan automatically creates records when scans complete with findings above your score threshold.
4
Application asset sync
When tagging cloud resources to an application, check FreshService in the Sync to ITSM section. ArcScan creates an Asset for the application and linked assets for each resource. See ITSM Application-Resource Sync.
PagerDuty
Trigger incidents for critical scan findings
1
Get a routing key
In PagerDuty: Services → your service → Integrations → Add Integration → Events API v2. Copy the Integration Key (routing key).
2
Configure in ArcScan
Go to Integrations → PagerDuty. Enter your Routing Key and Service ID.
3
Set trigger thresholds
Enable Auto-trigger on Critical and/or Auto-trigger on High severity findings. PagerDuty incidents are created automatically when findings match.
Datadog
Push scan metrics and events to Datadog dashboards
1
Get API and App keys
In Datadog: Organization Settings → API Keys (copy API key) and Application Keys (create and copy an app key).
2
Configure in ArcScan
Go to Integrations → Datadog. Enter your API Key, App Key, and site (e.g. datadoghq.com or datadoghq.eu).
3
Enable push options
Toggle Push Metrics (scan scores, finding counts) and Push Events (scan completed, critical findings) to populate your Datadog dashboards.
OPA Security Rules
Evaluate playbooks against custom Rego policies
1
Deploy OPA
Run an OPA server (Docker: docker run -d -p 8181:8181 openpolicyagent/opa run --server) or use an existing instance.
2
Configure in ArcScan
Go to Integrations → OPA. Enter your Server URL (e.g. http://opa:8181) and optional auth token.
3
Upload policies
Upload Rego policies via the OPA settings page, or push them directly to OPA's API. Set a default package (e.g. arcscan.ansible) for automatic evaluation.
Snyk
Scan dependencies for known vulnerabilities
1
Get a Snyk API token
In Snyk: Account Settings → General → Auth Token. Copy the token.
2
Configure in ArcScan
Go to Integrations → Snyk. Enter your API Token and Organization ID (found in Snyk org settings).
3
Enable auto-scan
Toggle Auto-scan to run Snyk vulnerability checks alongside every ArcScan playbook audit.
SSO Setup
Google, Microsoft, GitHub, GitLab, or SAML 2.0
1
Open SSO Settings
Settings → SSO (Enterprise plan required).
2
Choose provider
Google Microsoft GitHub GitLab SAML 2.0. For OAuth providers, register ArcScan as an app in the provider's developer console and enter Client ID + Secret.
3
Set allowed domains
Enter a comma-separated list of email domains (e.g. company.com, subsidiary.com). Only users with those email domains can sign in via SSO.
4
Test and enforce
Click Test SSO to open a pop-up login flow. Once verified, optionally enable Enforce SSO to prevent password logins for org members.
Sign in with Microsoft
Microsoft / Entra (Azure AD) SSO + partner domain auto-join
1
Use the Microsoft button
On the sign-in page, click Sign in with Microsoft to authenticate with your Microsoft / Entra (Azure AD) work or school account.
2
First-time consent
The first time someone from your tenant signs in, Microsoft may ask an admin to approve ArcScan's read-only profile access (User.Read). Approve once and future sign-ins are seamless.
3
Partner domain auto-join
For MSP partners, staff whose email domain your organization has claimed are auto-joined to your workspace on first Microsoft sign-in, no manual invite needed. Claimed domains are managed in SSO settings.
Tip: Google and GitHub single sign-on work the same way from the sign-in page.
MSP / Partner Console
Manage multiple client organizations as a partner
1
Become a partner
A platform administrator enables your organization as an MSP partner. The partner admin receives a setup/login email; once enabled, open the Partner Console from the menu.
2
Add client organizations
Use Add client to create a client workspace. Each client is an isolated organization with its own scans, reports, and data.
3
Build your team & grant access
Invite engineers to your partner team, then grant or revoke each engineer's access to specific clients, individually, in batch, or across all clients, from the team × clients grid.
4
Invite read-only client viewers
From Client Viewers, invite a client contact as a read-only viewer: they see their organization's results under your brand but cannot change anything.
5
Apply your branding
Set your logo and colors so client-facing reports, emails, the portal, and the Trust Center appear under your brand instead of ArcScan's.
6
Run the book
The Partner Overview shows one row per client (score, open criticals, KEV, assets, last scan). SLA / MTTR rolls up attainment per client against each client's own targets. Under Partner reports, schedule weekly or monthly branded executive PDFs per client, and generate a quarterly business review PDF for any client and quarter.
Security: viewer access and per-client grants are enforced server-side; a viewer can never write to, or read across, other tenants, and scheduled sends re-check the grant every time.
Arc Product Suite
À-la-carte products beyond ArcScan
1
Arc Redactor
PII/PHI sanitization with a transparent proxy and tamper-evident audit trail.
2
Arc Watch
AI/ML infrastructure observability, GPU fleet health, inference endpoints, and LLM cost.
3
Arc Terminal
Browser-based SSH with full session recording (asciicast v2) for audit and replay.
4
Quantum Arc
Post-quantum cryptography discovery (eBPF + host agents), aligned to NIST FIPS 203/204/205, with crown-jewel ranking, a crypto map, migration deadlines, and ring-based rotation. See Quantum Arc.
5
Arc Discover
Network sweeps, credentialed deep probes, snapshot side-scans, and the CMDB. See Run a network sweep.
6
Arc Tripwire
Decoy credentials and intrusion detection. See Arc Tripwire decoys.
Enabling products: Arc products are à-la-carte (individually or as a bundle). Manage entitlements on the Billing page or contact sales.
Run a Network Sweep
Agentless host and port discovery that feeds the CMDB
1
Open Network Sweeps
Inventory → Discovery Engine → Network Sweeps, then New sweep.
2
Set targets and backend
Enter Target CIDRs (comma or newline separated; a /16 is the largest single range). Pick a Scanner backend: tcp_connect (default), masscan, zmap, or nmap. Leave Ports empty for the top 25, and choose Run from an enrolled Arc Probe agent when the range is only reachable from inside a site. Public ranges require the authorization checkbox.
3
Read the results
The sweep page polls progress and lists each live host with open ports, service banners, and TLS certificate details. The PQC readiness of the edge card shows which TLS and SSH endpoints negotiate hybrid ML-KEM key exchange (see External PQC probe). Hosts land in Inventory → Assets.
4
Make it recurring
Create a cadence under Discovery Engine → Schedules with the same CIDRs, backend, and ports. Sweeps that observe new ARP or SNMP-route neighbors enqueue follow-up /24 sweeps unless you disable follow-ups in Discovery Settings.
Safe by default: tcp_connect completes a handshake and closes, the same traffic a load-balancer health check produces. No sweep writes to a host.
Run a Credentialed Deep Probe
Packages, services, users, and neighbors over SSH, WinRM, SNMP, SMB, or IPMI
1
Store the credential
Add an SSH key or password, a WinRM password, or an SNMP community string in the Vault. Secrets are Fernet-encrypted and decrypted only inside the probe worker.
2
Start the probe
Open the asset in Inventory → Assets and click Deep probe, or go to Discovery Engine → Deep Probes. Choose Protocol, Auth method, Username, and Vault secret; port and target-host overrides are optional.
3
Review the facts
The probe page polls to completion and shows OS and kernel, listening ports, installed packages, running services, users, ARP and LLDP neighbors, and routes. Linux probes also record the running kernel versus the newest installed kernel, so a patched-but-not-rebooted host is flagged.
4
CVEs follow automatically
Collected packages are matched against the nine CVE feeds at once; see the asset's Vulnerabilities tab or the CVE Dashboard. Recurring probes run from Schedules.
Scan method choice: hosts can also be inventoried by agentless snapshot side-scan (reads the package database off an AWS or Azure disk snapshot, works on stopped instances). Set the org default in Discovery Settings and override per host on the asset page; a skipped host is named in the run summary and never reads as clean.
Add an Environment in One Click
Run the whole collection chain for a new cloud account or on-prem site
1
Open Add environment
Inventory → Add environment → Add an environment (Senior Engineer or Manager).
2
Cloud account
Pick or create the credential. ArcScan verifies it, pulls inventory, builds topology edges, imports the AWS resource graph, runs a posture scan, pulls SSM inventory on AWS, matches CVEs, reconciles assets, and creates recurring schedules.
3
On-prem site
Choose the agent path (ArcScan mints a one-time bootstrap token and an install one-liner for Arc Probe; the token is never stored) or the SSH path (creates the deep-probe schedule and dispatches the first probes from a vault credential).
4
Watch progress
The run page in Environments shows each step and a coverage summary when it finishes.
Export VEX
Hand your other scanners ArcScan's verdict on each CVE
1
Per host
Open the asset in Inventory → Assets and click Download VEX (OpenVEX) or VEX (CycloneDX), next to Download SBOM.
2
Org-wide
On the CVE Dashboard filter bar, use the OpenVEX, CycloneDX VEX, or CSAF VEX buttons. The export honors the active filters but defaults to every status so the not-affected statements are included.
3
Pick the format
OpenVEX for Grype, Trivy, and most open-source scanners. CycloneDX VEX when you also consume the CycloneDX SBOM; the two join by component reference. CSAF VEX for enterprise advisory pipelines that ingest CSAF 2.0.
Dispositions: open and reachable = affected with the target version as the action; open and unreachable = not_affected citing the analyzer reason; fixed-in-place or fixed = fixed; false positive, suppressed, and vendor-managed pins = not_affected; risk-accepted pins stay affected with a no-upgrade statement; unknown reachability = under_investigation.
Arc Tripwire Decoys
Credentials with no legitimate use, so any use is an alert
1
Open Arc Tripwire
Settings & Workspace → Arc Tripwire (requires the Arc Tripwire add-on).
2
Mint a decoy
Choose a Type and a Label saying where you will plant it: an AWS access key from Arcus Forge's deny-all pool account, an ArcScan API token in the real arcscan_ format, a web URL that always answers 404, an Azure service principal in a pool tenant, or an LLM lure for an AGENTS.md file. The credential is shown once.
3
Plant it
Paste it into a config, repo, or wiki yourself, or click Deploy decoy to write it onto a host through an enrolled Arc Probe agent (pick the Unix user, .env path, or AGENTS.md directory).
4
Respond
Any use raises an intrusion event on All detections and an incident on the On-Call page, fanned out to your Slack, Teams, or Discord webhooks. Revoke the decoy from the same page when done.
Real credentials are watched too: an API token or agent key seen from an IP outside its seven-day baseline, or a machine-regular burst of 4xx responses, opens an incident without any decoy. Detections are deterministic.
Ask ArcScan
Plain-English questions over your security graph
1
Open Ask ArcScan
Home → Ask ArcScan. You need an AI provider key (see Add an AI API key).
2
Ask
"Which internet-facing hosts are vulnerable to CVE-2026-1234?", "What is the blast radius of db-01?", "Summarize our KEV exposure", "Search ServiceNow for open changes on the web tier". The model routes each question to at most four read-only, tenant-scoped tools.
3
Turn a question into a rule
Click Draft a rule to hand the question to the custom-rule drafter (see Draft a custom rule).
Read-only by construction: write tools are not reachable from the chat, and tool output (including ServiceNow record text) is treated as untrusted.
Draft a Custom Rule in Plain English
AI drafts the rule and a canary pair; the server proves it discriminates before you can save
1
Open Custom Rules
Settings → Custom Rules, then Draft with AI.
2
Describe the rule
Type what it should flag, for example "any shell task that pipes curl into bash", and click Draft. Your provider returns a keyword, regex, YAML-path, or module-usage rule with severity, message, and remediation, plus a canary pair: one minimal playbook that must match and one that must not.
3
Verify, then save
Click Verify. ArcScan runs the real rule engine over both canaries on the server. Save is enabled only when the rule matches the positive canary and not the negative one, and the save endpoint re-verifies.
What the canary means: it is proof the rule discriminates. A pattern that matches everything, or nothing, can never be saved. Drafts are sanitized at the boundary (caps, enums, unsafe-regex guard), the canaries are not stored, and the saved rule records the verification date in its description.
Connect an AI Agent (MCP Server)
Let Claude Code or any Model Context Protocol client query ArcScan with your token
1
Create an API token
Open Settings, scroll to the ArcScan API tokens panel, create a token, and copy the arcscan_... key. It is shown once.
2
Register the server
For Claude Code:
claude mcp add --transport http arcscan https://arcusautomate.com/api/v1/mcp/ --header "Authorization: Bearer <token>"Any other MCP client: HTTP transport to /api/v1/mcp/ with an Authorization: Bearer or X-API-Key header. Self-hosted installs use their own hostname.
3
Use the tools
list_findings (cloud, CVE, Quantum Arc, and playbook findings under one id scheme), get_asset, search_assets, list_cves (KEV-only, reachable-only, minimum EPSS), posture_summary, and request_remediation, which creates a proposed run on a cloud finding and nothing more; the dry run, policy gate, and human approval still happen in ArcScan.
Same guardrails as a human: the agent sees only the token owner's organization and role, every tool call writes an audit-log row, rate limits match the REST API, and a token belonging to a deactivated user stops working at once. The REST and MCP reference lives under API Docs.
Continuous ATO and the External Auditor Portal
OSCAL packages, assessor access, and evidence your auditor can verify offline
1
Open the CATO dashboard
Comply & Report → Compliance → CATO tracks control implementation per framework with an evidence chain behind each control.
2
Generate an ATO package
Click Generate to build an OSCAL System Security Plan, OSCAL Plan of Action and Milestones, and OSCAL Assessment Results as JSON, downloadable as one bundle.
3
Invite an assessor
Under Assessor access, click Invite Assessor with a name, email, and expiry. ArcScan mints a login-less, read-only portal link; every access and denial is audit-logged, and the link can be revoked at any time.
4
Export verifiable evidence
From the Evidence Locker, download a framework's bundle: controls, evidence chain, POA&M, a 90-day audit-log slice, the compliance PDF, and an HMAC-signed manifest verifiable offline with arcscan airgap verify --bundle manifest.arcscan.
Crosswalk: evidence collected for one framework propagates to crosswalked controls in SOC 2, ISO 27001, NIST CSF, and NIST 800-53 on the Crosswalk page, reported as a distinct "covered via crosswalk" state.
Publish a Trust Center
A public, token-gated posture page prospects can read without an account
1
Open Trust Center settings
Comply & Report → Trust Center (org admin or owner).
2
Publish
Under Publishing, set a public slug and a contact email and enable the page. Under Sections, toggle posture grade, compliance framework coverage, vulnerability SLA attainment and MTTR, SBOM availability, CBOM and post-quantum readiness (with Quantum Arc), and your plain-text security program statements.
3
Share
Copy the Share link. It carries a token by default, so only people you send it to can open it. Rotate the token to cut off old links, or switch the token requirement off for a fully public page. Indexing is off unless you opt in.
4
Handle requests
Visitors can Request access or documents (SBOM, CBOM, or other). Requests land in the Requests inbox on the settings page, where you track status.
What it never shows: an asset name, hostname, or IP. Each panel is isolated, so a failing collector renders "unavailable" instead of an error, and white-label branding applies.
Quantum Arc: Findings, Crown Jewels, Crypto Map
Work the crypto inventory inside ArcScan
1
Connect the appliance
Enter the appliance URL and credentials under Integrations → Quantum Arc. Findings sync every six hours and persist in ArcScan, so every page below works while the appliance is down.
2
Triage findings
Marketplace → Quantum Arc lists SSH keys, X.509 certificates, and keystores with an algorithm-aware severity. Sort by blast to surface crown jewels first, or by Due by for the migration deadline. System trust anchors (the OS CA bundle, JVM cacerts) are recognized and never offered a rewrite.
3
Read the posture page
Crypto Posture shows the trend, the Crown Jewels card (score = severity × role, plus reach: a customer CA outranks an SSH host key, which outranks a TLS cert, keystore, and user key; reach counts hosts sharing the same key material and certificates a CA signed), the Migration deadlines panel, and the External Edge panel.
4
Open the Crypto Map
Marketplace → Crypto Map draws hosts (colored by worst severity), your CAs (stars), external issuers (hexagons, toggleable), and one hub per key reused on two or more hosts. The drawer links each node to its findings and remediation preview.
5
Export
Download the CBOM (CycloneDX 1.6, with blast-radius and crown-jewel properties) or the readiness PDF with its crown-jewel and deadlines sections.
PQC Migration Deadlines
A must-migrate-by date on every quantum-vulnerable finding
1
Pick a regime
The Regime selector on Crypto Posture and the findings list switches between NIST (default) and CNSA 2.0. The choice is a per-page parameter today, not a saved org setting.
2
How NIST dates are computed
From the NIST IR 8547 initial public draft: 112-bit quantum-vulnerable public-key algorithms (RSA-2048, DH-2048, P-224) are deprecated after 2030-12-31; every quantum-vulnerable public-key algorithm is disallowed after 2035-12-31. P-256 is 128-bit per SP 800-57, so it takes the 2035 date. Hybrid and PQ-safe findings have no deadline, broken-now findings are due now, and symmetric or protocol findings get no date.
3
How CNSA 2.0 dates are computed
Each finding is placed in a use category from its type, path, and hostname (SSH and trust anchors are OS, CA certs are PKI, VPN is networking, code or firmware signing is signing, TLS is web). The category's exclusive-by date applies: signing 2030, web and cloud 2033, networking 2030, operating systems 2033, PKI 2033, custom or legacy 2035.
4
Where it shows
The Migration deadlines panel (countdown, findings due per year, burn-down, category table), the Due by column and Due before filter on findings, a "PQC deadline" tile on the Executive dashboard, and a Deadlines section in the readiness PDF.
External PQC Readiness Probe
Does your TLS and SSH edge negotiate hybrid ML-KEM?
1
Run a tcp_connect sweep
The probe runs automatically after banner grab for every TLS and SSH port a network sweep finds with the built-in tcp_connect scanner. masscan, zmap, nmap, and agent sweeps do not probe today.
2
How TLS is judged
ArcScan sends a TLS 1.3 ClientHello offering only hybrid groups (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024, and the Kyber draft). A ServerHello or HelloRetryRequest selecting one of them is Ready; a handshake failure, classical retry, or TLS 1.2 fallback is Not ready.
3
How SSH is judged
ArcScan reads the server's KEXINIT and looks for mlkem768x25519, mlkem1024nistp384, mlkem768nistp256, or sntrup761x25519 (either spelling). The full key-exchange list is kept in the detail.
4
Read the verdicts
Per-port badges and a Ready / Partial / Not ready / Unknown column on the sweep page, the PQC readiness of the edge card, and the External Edge panel on Crypto Posture.
Why a host shows Unknown: the probe got no usable answer, which is a timeout, a connection reset, a closed port, or garbage back. Unknowns are left out of the percentage rather than counted either way. IP targets are probed without SNI, so a virtual host that requires it may answer for its default site.
Ring-Based Rotation Rollouts
Canary, then a percentage, then the fleet, with a health check between rings
1
Create a program
Open Marketplace → Rotation Rollouts. Give it a Name, select findings by Crypto type and optional Algorithm or hostname list, and pick a Ring template.
2
Set the health policy
Soak minutes between rings, Failures tolerated per ring, check mode on or off, and whether a live program requires a prior successful dry run per finding.
3
Start and watch
Hosts are assigned to rings by a stable hash so a ring never changes between plan and dispatch. Each host gets its own AWX job through the normal per-finding remediation path, limited to that hostname. A background task polls every five minutes, waits out the soak, and advances when healthy. Pause, Resume, Abort, and Advance now (skips the soak, never the health check) are on the program page.
What halts a program: failures beyond the tolerance, a live SSH rotation that has not published its new known_hosts line, or a live X.509 rotation that has not re-synced as resolved with a new fingerprint. A halt notifies the owner and creator and fires a webhook. Nothing is rolled back automatically; each run keeps its own Roll back control. A live program is refused when change management is required; use the per-finding governed path instead.
Certificate Issuance to Fleet Hosts
X.509 rotations get a replacement from the appliance CA when the agent is present
1
Install the Quantum Arc agent
Hosts with /usr/local/bin/arc-quantum-agent enrolled against the appliance qualify. ACME-managed certificates still renew through certbot instead.
2
Run the X.509 remediation
From a certificate finding, generate and run the playbook (check mode first). On a qualifying host the play asks the agent to issue a short-lived ECDSA-P384 replacement from the appliance CA over the agent's signed channel. The key is generated on the host and never leaves it, and the appliance refuses names outside the enrolled hostname.
3
Safety
The original material is backed up first; nothing is installed and no service reloads unless issuance succeeded; a refused issuance fails the play with the original certificate untouched; the restart rescue rolls this branch back too. The run artifact records issuer, serial, and expiry.
Known gap: the agent's renewal timer refreshes the staged files, not the installed path. Re-run the play to install a renewal. Hosts without the agent fall back to a self-signed interim certificate with an operator notice.
SCIM 2.0 Provisioning
Let Okta, Entra, or OneLogin create, update, and deactivate users
1
Mint a token
As a Manager, open Team & Access → Team Management, switch to the SSO tab, and under SCIM 2.0 Provisioning click Mint SCIM Token. Copy it now; it is shown once and stored hashed.
2
Configure the IdP
Create a SCIM application pointing at your ArcScan SCIM base URL with that bearer token. Users support create, read, update, userName filtering, and pagination.
3
Map groups to roles
Push groups named after the five functional roles (Business, Engineer, Senior Engineer, Manager, Auditor); membership maps one-to-one. The same tab holds the SAML group-to-role mapping.
Deprovisioning: a SCIM delete deactivates the user, kills their sessions, and stops their API tokens (including MCP access) rather than hard-deleting. Every mutation is audit-logged.
WebAuthn Security Keys
Register a FIDO2 key or platform authenticator as a second factor
1
Open 2FA setup
Settings → Two-factor authentication. Enable a code factor first (TOTP, email, or SMS) so you keep a fallback.
2
Register the key
Click the WebAuthn register action and follow the browser prompt for a YubiKey, Touch ID, or Windows Hello. You can register more than one.
3
Sign in
After your password, touch the key when prompted. 2FA is enforced by middleware on every signed-in request, so no page skips it, and brute-force lockout covers the login and 2FA forms.