Sensors
A sensor is a Linux host on your network that runs the Orbital agent. The agent runs in Docker, takes scan jobs from the console, runs the scanners and sends the results back. Sensors scan what they can reach on your networks, which is why they live inside them. Before you start You need: A Linux host or VM with root access. See Skills and requirements for the supported systems and sizes. In short: Ubuntu 22.04/24.04, Debian 12 or RHEL/Rocky/Alma 9, and 4 vCPU, 8 GB RAM and 30 GB free disk for network vulnerability scanning. Outbound HTTPS from the host to the console. The Administrator role in your organisation (or a personal account). Room on your plan. If you've reached your plan's sensor limit, the console tells you; remove a sensor or upgrade on the Subscription page. Add a sensor In the console, go to Sensors and choose Add sensor. Enter a Sensor name (1 to 64 characters), for example the site or network it scans, such as hq-office-scanner. Choose Get install command. Copy the command. It looks like this: The command checks the installer before running it: it downloads the script, compares its SHA-256 checksum with the one in the command, and runs it only if they match. Otherwise it stops with Checksum mismatch: this is not the OrbitalCyber installer. Nothing was run. Copy the command from the console each time: the checksum changes with each release. Run it as root on the sensor host. The installer: checks the operating system and architecture, installs Docker if it's missing (it asks first), checks the host's resources, enrolls the sensor with the token, starts the agent container, which restarts automatically with the host. Choose Done. The sensor appears in the list within a minute. [!WARNING] The install command contains a one-time token. It works once and expires after an hour. Treat it like a password and don't paste it anywhere public. If it expires, add the sensor again to get a new command. [!TIP] If you run the installer without a terminal (for example from automation), it can't ask before installing Docker. Add --yes after the token to accept, or install Docker first. After enrollment Once enrolled, the sensor shows as online in the list. Its status is one of: Status Meaning online Connected and ready scanning Connected and running scans offline Not heard from for the last few minutes revoked Permanently disconnected (see below) The agent checks the host's resources and reports its Capability (Lite, Standard or Performance) and the Engines it can run. If the host is too small for something, the sensor's page says what to add, for example how much RAM or disk space. After you resize the host, choose Re-check resources. When a sensor is first set up, it still has to download its scanners and vulnerability content. The Scanners tab shows the progress: for example Not synced yet for Nuclei templates, or Scanner loading feed for OpenVAS. The sensor's page Select a sensor's name to open its page. The tabs are: Tab What it shows Overview Host name, uptime, CPU, memory, architecture, kernel, capability, agent version, engines, identity fingerprint and free disk space Scanners Scanner versions and vulnerability content on this sensor compared with the latest available, and the Keep the OpenVAS scanner running between scans switch Network The host's interfaces, addresses, default gateway and DNS servers Performance Live resource use (only while the sensor isn't revoked) Honeypot Decoy services on this sensor. See Honeypots Scans This sensor's recent scans Keep the OpenVAS scanner running By default (recommended), the OpenVAS scanner starts for each scan, loads its tests (a few minutes) and stops when idle, so the host isn't under load for nothing. Turn on Keep the OpenVAS scanner running between scans if you want scans to start immediately. That costs about 1 GB of memory and some CPU all the time. Sensor actions These are in the sensor's row menu and at the top of its page: Action What it does Re-check resources Runs…
OrbitalCyber documentation