For a device to be inventoried, Portail ZAPP must know where it is allowed to look (the declared networks) and how to connect to it (the credentials and their assignments). These settings open access to your devices: creating or changing them goes through an approval, decided by someone other than the requester.
The screens are reserved for the Administrators group. Open them from the Declared networks, Credentials, Assignments and Approvals tabs of the network inventory. Running scans and validating hosts are described in the page "Inventorying the network".
Declared networks
A scan scope can only target addresses that belong to one of the declared networks: this is the allow list that prevents a booby-trapped target from being added. To declare one, enter a Name and an IPv4 CIDR (for example 192.0.2.0/24), then click Add: the request goes to approval.
Deleting a network applies immediately, but it is refused if a scope would no longer be covered: "Deletion refused: the following scope would no longer be covered: …".
Credentials
A credential describes how to connect to a type of device. It never contains a secret: each sensitive field (password, community, key…) refers by name to a secret of the Secrets vault module, read only when it is sent to the Outpost. Without this module, no secret can be chosen; if no secret exists yet, a create one link is offered.
Click + New credential, choose the Type, then fill in the fields of the type:
- SNMP v1/v2c: the community travels in clear text on the network. You must confirm "I confirm this community is read-only" and give a Justification for using SNMP v1/v2c;
- SNMP v3: Authentication + encryption (recommended) by default; a weaker level requires a justification;
- SSH: a password or a private key (secrets). Fill in the Expected host key fingerprint, or tick Pin the host key on first connection: one of the two is required. A key change then blocks the connection and raises an alert;
- WinRM: always over HTTPS. Authentication set to Negotiated (recommended) lets WinRM choose; forcing NTLM requires a justification. A WinRM credential can only be assigned to the Windows host and Server types;
- HTTPS API: HTTPS address, token or user and password, expected certificate fingerprint. This type is not used for the inventory yet.
Click Submit: creation and changes both go to approval. The type of a credential cannot be changed afterwards. Deleting a credential applies immediately and also deletes its assignments.
Assignments
A credential is only used on the scopes and for the device types it is assigned to, and only for a host validated with that type. Choose a Credential, a Scope and a Device type, then click Submit assignment: it goes to approval. An assignment that already exists is refused. Deleting an assignment applies immediately.
Approving or rejecting a request
The Approval requests page lists pending requests: their kind (Scope, Declared network, Credential, Assignment), the operation (Creation or Change), the requester and the date. Show history also shows processed requests (Approved, Rejected, Withdrawn, Apply failed); Pending only returns to open requests. Nothing is written until the request is approved.
- Approve or Reject, with an optional Comment (at most 1,000 characters). You cannot approve your own request: "You cannot approve your own request (four-eyes rule)." It stays "Waiting for another approver.";
- Withdraw my request: the requester cancels their own request while it is pending.
An approved change is checked one last time when it is applied; if it is no longer valid, the request becomes Apply failed.
Approval settings
At the bottom of the approvals page:
- Approval process (Workflow): choose a published process so that its validations decide instead of a manual decision. The request then shows "Waiting for the process approvers." and only the designated approvers decide. None — manual decision by another user returns to the four-eyes rule. Without the Process orchestration module, only manual decision is possible;
- Allow the requester to approve their own request: reserve it for single-administrator installations, because the four-eyes rule is then disabled.