Saltar al contenido principal

Your first scan

After installing the agent and running the scan command, your report is generated automatically.

What happens after a scan​

  1. Agent data received — the API validates and stores the ingest payload
  2. Analyzing security posture — an AI model analyzes the collected data and generates findings
  3. Report ready — the full report appears in the dashboard (usually under 2 minutes)

You can watch the progress in the dashboard. The machine card shows a "Scanning" status while the report is being generated.

Scan results​

Once complete, the machine card shows:

  • Security health score (0-100) — overall security posture
  • Lifecycle status — whether the OS is still supported
  • Firewall status — active or inactive
  • Pending security updates — number of unpatched packages

Click View report to see the full analysis.

Rescanning​

The agent installed by the bootstrap flow runs subsequent scans without going back to the dashboard:

sudo ghostpsy scan --yes              # one-off scan now
sudo ghostpsy cron install             # weekly schedule (default)
sudo ghostpsy cron install --schedule=daily

Each scan uses the long-lived agent token at /etc/ghostpsy/agent.conf. Previous scan results are preserved in the scan history.

If you need to re-image the host or rebind the credential, open the machine page in the dashboard and use Rebind on the row of the existing agent token; the next scan re-attaches it to whatever host reports first.