Continuous asset inventory on large networks: distributed scanning and change tracking
You keep the inventory of a network with thousands of addresses up to date: you set up a distributed scanning architecture and schedule, reconcile results with the asset database, track changes and run a workflow for ownerless assets.
Level 501 · 15 lessons · 15 practice labs
Lessons
Scale
- Thousands of addresses: time, bandwidth and noise
- Distributed scanning architecture: regional scanners and a hub
- The scan schedule: business hours, maintenance windows and priority
- Authenticated inventory: agents and management interfaces
- Short task: design a scanning architecture for an organisation with three sites
Data
- The inventory data model: asset, service, owner, criticality
- Reconciling scan results with the asset management database
- Change detection: new ports, new devices, vanished services
- Alert rules for unexpected changes
- Short task: resolve the differences between the scan and the recorded inventory
Operating
- Coordinating scan traffic with the monitoring teams
- Inventory quality metrics: coverage and freshness
- A workflow for ownerless assets
- Verifying segmentation rules from the inventory
- Capstone: build a continuous inventory pipeline for a fictional organisation and report the first differences
Practice labs
- Prepare a scan schedule that fits maintenance windows: Write a weekly scan schedule for three subnets using Kumsal Turizm's business hours and maintenance windows.
- Design a regional scanner architecture for three sites: Place regional scanners and a central collector for Mavikaya Lojistik's three warehouses and add the bandwidth estimate.
- Tune the architecture by measuring scan time and network load: Scan the same scope with two lab scanners and reset batch size and rate limit based on measured time and traffic.
- Fill in the inventory data model: Load scan results into a model with asset, service, owner and criticality fields and flag the missing fields.
- Resolve differences between scans and the registered inventory: Compare Ilgıntepe Tekstil's asset database with the latest scan, classify extra and missing records and produce a correction list.
- Merge asset records from several sources: Write the rule that merges scan, DHCP and management-interface data into single asset records and resolve the conflicts.
- Create a change record for a newly opened port: Detect the newly opened port from two days of scan data and write a change record with owner, time and service.
- Write alert rules for unexpected changes: Define alert rules for a new device, a new management port and a vanished critical service and show they fire on the lab data.
- Reduce noisy change alerts and catch the one that slips through: Tune Selvikent Belediyesi's rules that produce hundreds of alerts using approved changes, and find the real change hidden among them.
- Measure the inventory's coverage: Compare the known subnets with the scanned ones, calculate coverage and list the unscanned ranges.
- Find and refresh stale inventory records: Find records older than thirty days by last-seen date, rescan them and archive the ones that no longer exist.
- Run the workflow for ownerless assets: Find the ownerless assets in Bakırdere Madencilik's inventory, run the owner-finding steps and report the results with the freshness metric.
- Derive the segmentation rule table from the inventory: Use the zones and services in the inventory to build the table of which zone should reach which.
- Validate segmentation rules with a scan: Scan from the guest network into the server network and record the services reachable against the rule table as findings.
- Close a segmentation gap and re-verify from both sides: Close the access left open from Lavinya Klinikleri's office network to the medical device network, prove it with scans in both directions and update the inventory.
About this course
You keep the inventory of a network with thousands of addresses up to date: you set up a distributed scanning architecture and schedule, reconcile results with the asset database, track changes and run a workflow for ownerless assets.
What you will learn
Prerequisites
You should be experienced in the topics of the same path up to level 401.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 501; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.