Getting started
OrbitalCyber finds vulnerabilities across your networks, websites, computers and cloud accounts, and keeps track of them until they're fixed. This page explains the pieces and walks you through your first scan. Your console is at . What OrbitalCyber is made of Piece What it does Where it runs Console The web app where you run scans, review vulnerabilities and assets, and manage everything else. In your browser Sensors Scanner hosts on your networks. Each runs the Orbital agent in Docker and scans what you point it at. A Linux host or VM you provide Cloud scanners Scanners we run for your internet-facing systems: websites, VPN gateways, mail servers and anything else with a public address. Nothing to install. Run by OrbitalCyber (depends on your plan) Endpoint agents A small agent on workstations and servers that reports the machine's details, installed software and patches. Windows 10, 11 and Server; macOS; Linux with systemd Honeypots Decoy services on your sensors. They show who probed them and what they tried, and alert the people you choose. On your sensors How the pieces talk to each other Sensors connect out, never in. A sensor makes outbound HTTPS connections to the console address shown in its install command, including a long-lived connection the console uses to send it work. You don't need to open any inbound port on your firewall for a sensor. Sensors enroll once with a one-time token. When you add a sensor, the console gives you an install command containing an enrollment token. The token works once and expires after an hour. After enrolling, the sensor proves who it is with its own identity key, which you can see as the Identity fingerprint on the sensor's page. Sensors keep themselves up to date. They download scanner updates and vulnerability content on their own, and update the agent while they're idle. Results are stored safely if the connection drops. A sensor keeps scan results on its disk until the console accepts them, then uploads them. Endpoint agents report outbound only. They send their reports over signed HTTPS connections from the computer to OrbitalCyber. Cloud scanners scan from the internet. Their scans come from the addresses listed on the Cloud scanners page, so you can allow them through your firewall, WAF or IPS. [!WARNING] Only scan systems you own or are authorised to test. Scans that start from a cloud scanner ask you to confirm you're authorised to scan the targets. [!NOTE] Not a customer, and seeing traffic from our scanners? You can stop our cloud scanners from scanning your domain with one DNS record. See Opting out of scanning. First steps Sign in to the console. If you work in an organisation, make sure you're in the right one: everything you add belongs to the organisation you're signed in to. Use Switch user/org at the bottom of the menu to change. Check your plan. Open Subscription to see what your plan includes (for example how many sensors, cloud scanners, Active Directory assessments or cloud posture assessments). Check that your sensor host is ready. Read Skills and requirements before you start. You need a Linux host with root access. Add a sensor. Go to Sensors and choose Add sensor, then run the command it shows on your Linux host. The sensor appears in the list within a minute. See Sensors for the details. Run your first scan. Go to Scans, choose New scan, pick your sensor and a scan type (for example Discovery: live hosts & open ports or Network vulnerability scan (OpenVAS)), enter your targets and start it. See Scans. Review what it found. Open Vulnerabilities for everything your scans have found, worst first, and Assets for the hosts, cloud accounts and domains that were assessed. See Vulnerabilities and assets. Get told about what matters. Set up email or Pushover alerts under Notifications. See Notifications. Where things are in the console Menu item What you'll find Home Your dashboard Vulnerabilities Everything your scans have found, worst first Assets Hosts, cloud…
OrbitalCyber documentation