Technical Note: Do not isolate when scan fails
Description
Prevent a host from moving to Remediation VLAN when a particular scan fails. This is useful when testing new scans, or simply looking to collect data from the scan results without impacting hosts that fail the scan.
Scope
Version: 8.x
Solution
1. In the Administrative UI, navigate to Policy > Policy Configuration.
2. In the menu on the left click the + sign next to Endpoint Compliance to open it.
3. Click the Scans option to select it.
4. On the Scans View, click Add to add a new Scan or select an existing Scan and click Modify.
5. In the General tab, select Audit Only from the Remediation drill-down.
6. Click OK to save the Scan.
Note: If modifying an existing scan, be aware of the following...
Once a scan is set to Audit Only, no action is taken to change the status of the host regardless of scan outcome (pass or fail). Hosts marked Safe for the edited scan remain safe, At-Risk hosts remain at-risk.
Prevent a host from moving to Remediation VLAN when a particular scan fails. This is useful when testing new scans, or simply looking to collect data from the scan results without impacting hosts that fail the scan.
Scope
Version: 8.x
Solution
Use the Audit Only option in the desired scan.
Using this option, if a host is scanned, the information associated with the scan is recorded but hosts that fail are not marked "at risk." Therefore, it is not forced into Remediation and can continue using the network. The administrator can review the scan results and take corrective action without disrupting users on the network.
1. In the Administrative UI, navigate to Policy > Policy Configuration.
2. In the menu on the left click the + sign next to Endpoint Compliance to open it.
3. Click the Scans option to select it.
4. On the Scans View, click Add to add a new Scan or select an existing Scan and click Modify.
5. In the General tab, select Audit Only from the Remediation drill-down.
6. Click OK to save the Scan.
Note: If modifying an existing scan, be aware of the following...
Once a scan is set to Audit Only, no action is taken to change the status of the host regardless of scan outcome (pass or fail). Hosts marked Safe for the edited scan remain safe, At-Risk hosts remain at-risk.
