Concepts

The handful of objects Asterion is built from, and how they relate.

Tenant

A tenant (mandator) is a customer or an organisational unit. Everything — targets, hosts, plans, runs, findings, reports, notification channels — belongs to exactly one tenant. Users are members of one or more tenants with a role per tenant. A tenant switches the three products on or off:

Switching a product off pauses it: its menus disappear, its plans are no longer sent to satellites and its findings are hidden. Nothing is deleted.

Target and host

A target is what you type in: an IPv4 or IPv6 address, a hostname, a network (192.0.2.0/24), a range (192.0.2.10-20) or a domain.

A host is a machine. Polaris groups every address that belongs to the same machine into one host: its IPv4 and IPv6 addresses and its hostnames. The correlation uses known addresses, DNS answers reported by satellites, forward-confirmed PTR names and SSH host keys. Hosts found inside a network target appear on their own.

Satellite and zone

A satellite (Pulsar) is a container that runs the checks. It is either global (usable by every tenant, created by an operator) or belongs to one tenant.

A satellite stands in a zone: external (the internet) or a zone of the tenant such as office or dmz. Global satellites are always external and never get private addresses. A tenant satellite gets its zone from the manual tag zone=<name>; without one it is external. The zone decides which exposure policy rules apply to what it sees.

Test plan, schedule, run

A test plan runs one check (for example nmap or https) on a set of targets, groups or hosts, from a set of satellites, on one or more schedules (every n minutes, daily at a time, or once). Each check has parameters with defaults.

Many plans are automatic: when you add targets for some satellites, Polaris creates and maintains the port scan and its follow-up checks, plus hourly ping and traceroute to every host. You never edit those; you set their interval per tenant under Features.

A run is one execution of a plan on one satellite. Satellites keep their plans on disk and run them on their own clock, also when Polaris is unreachable; results are cached until Polaris accepts them.

Discovery and follow-up

• Discovery checks find what exists: nmap, ping, traceroute.
• Follow-up checks look closer at what discovery found: http, https, cert, smtp, ftp, details. They take their ports from the last port scan of the same satellite (Which ports: discovered, manual or both). A newly discovered service gets its follow-up checks right away on websocket-connected satellites.

Service, observation, event

A service is a port of a host with what runs there. An observation is that service as one satellite sees it on one address. An event is a change in history: appeared, disappeared, fingerprint changed. A port counts as closed only after two scans in a row miss it — one scan can lose a port.

Finding

A finding is a problem an analyzer found: an expiring or untrusted certificate, a forbidden service in a zone, missing DMARC, a name server that does not answer authoritatively, an open relay. Findings open and resolve automatically when the cause disappears.

The first scan is a baseline

The first result for a host, a domain or a CT log never alerts: it is what is there. Notifications start with the second result that differs.