Scan Engines

Scan Engines are the workhorses of the scanning process and operate solely at the discretion of the Security Console. They are responsible for discovering assets during a scan, checking them for vulnerabilities, and assessing their level of policy compliance (if your selected scan template is configured to do so). Although Scan Engines serve as data collectors, they only temporarily store this data on their respective host machines. Instead, the Security Console integrates Scan Engine data into the PostgreSQL database for you to see and report on. This is why Scan Engine host machine storage requirements are far lower than what the Security Console requires.

Scan Engine Types

The Security Console can use multiple Scan Engines of various types that are designed to meet the configuration needs and scanning demands of your network.

Local Scan Engine

All installations of the Security Console include a local Scan Engine so that you can start scanning immediately after your initial deployment. While convenient, the local Scan Engine is best suited for very small scale deployments and trial experiences of the product.

Distributed Scan Engine

Distributed Scan Engines are the most widely used engine type and are essential for any production scanning deployment. Unlike the local variety, you install distributed Scan Engines on separate host machines from the console itself. As a result, they can make use of more processing resources for scanning tasks and you can efficiently distribute them depending on the geographic spread of your assets. You can also configure each distributed Scan Engine to communicate with the Security Console in a way that accommodates the presence of any firewalls on your network.

External Scanning Service

If you rather not deploy a Scan Engine on your own resources, Rapid7 offers access to Scan Engines provisioned through our External Scanning Service that are dedicated to your organization. These external Scan Engines are also useful for determining what attackers can see on your external assets that are accessible to the internet.

If you are already licensed for the External Scanning Service, see the External Scanning Service page for instructions on how to complete the pairing to your Security Console.

Scan Engine Pool

If your product license supports engine pooling, you can group multiple distributed Scan Engines together in order to improve site scanning speed.

See the Scan Engine Pools page for instructions on creating and using Scan Engine pools in your environment.

Scan Engines in Virtual and Cloud Environments

You can install the Scan Engine in most virtual and cloud environments. For easy installation, the Scan Engine is available in the marketplaces of several popular cloud infrastructure providers. You can read more about these options in the following resources:

• Our Amazon Web Services (AWS) integration article.
• Azure's Marketplace listing for the Scan Engine and our companion Azure Scan Engines article.
• Our Virtual Appliance Guide that includes the Scan Engine OVA download.

Scan Engines in Site Configurations

All sites must specify at least one Scan Engine or engine pool for use during a scan. You can view and select from all your individual and pooled Scan Engines on the Engines tab of any open site configuration.

Asset Scanning Options

On the Scanning tab, the following options are available:

• Scan with Engine
• Scan with Engine Pool
• A dropdown menu allows you to select your desired scan engine or pool.
• Always use the selected engine - This option is selected by default. By deselecting this option, you will allow the scan to use the engine that was most recently used for each asset. Note: This may result in multiple scan engines being used for this site. This can improve scan efficiency if your targeted asset group includes geographically dispersed assets.

Scan Engine Management

You can view, create, edit, update, and check the status of your Scan Engines from the engine management screen. To access this view, click the Administration tab in your left navigation menu. In the “Scans” section, click Manage scan engines next to “Engines”.

The Scan Engine management screen lists all your added Scan Engines and displays relevant information like connection status, communication direction, and version information. You can also add new engines, configure engine pools, and adjust the communication direction of your existing engines from this screen.