On-site collection

The infrastructure connectors read your hypervisors, directory and firewalls. With direct access, TechWatchAlert connects to them over the Internet, so their administration must be published, with a public certificate. On-site collection avoids this: a TechWatchAlert agent installed in your network reaches the device on our behalf and returns the answers.

Connectors concerned: VMware vCenter, VMware ESXi, Microsoft Hyper-V, Nutanix Prism Central, Proxmox VE, Active Directory (LDAPS), FortiManager, FortiGate, Stormshield SNS, and the consoles of the scanners read through their API Tenable Security Center and Rapid7 InsightVM (port 3780 allowed). Cloud services (Entra ID, Defender, Meraki, Cortex XDR, ServiceNow, Tenable Vulnerability Management, Qualys, Insight Platform, CrowdStrike) stay on direct access.

How it works

• The agent calls TechWatchAlert over HTTPS and waits for the connector’s requests; it opens no port on the machine, all its connections are outbound.
• It only reaches the address and port of the connector, set in an authorisation signed by TechWatchAlert (valid for 30 days, renewed automatically, withdrawn when you delete the connector, switch agent or go back to direct access). Any other destination is refused by the agent itself.
• On-site collection is disabled by default on every machine: it is only enabled with your consent, on the machine (see below). TechWatchAlert cannot enable it remotely.
• The device’s certificate is always verified: by the certificate store of the agent’s machine, or by the SHA-256 fingerprint you provide (self-signed certificate). Verification is never disabled.
• The address can be internal (https://10.0.0.5, https://vcenter.company.local): TechWatchAlert never connects to it.
• For Active Directory, the agent runs the read-only search itself (computer objects, fixed attributes, authorised search base); it opens no tunnel to the directory.

The nightly synchronisation and the Sync button work as with direct access. If the agent is offline, the synchronisation fails with a clear message and resumes as soon as it is back.

Setting it up

1. Pick a machine that can reach the device (management server, a machine of the management network rather than a workstation) and install the agent 1.3.0 or later on it, adding the --relais option to the installation command shown in Fleet › Agents:

   sudo ./techwatchalert-agent installer --serveur … --jeton - --empreinte … --relais

   On a machine that already has the agent, without reinstalling, as administrator (Windows) or with sudo:

   techwatchalert-agent relais activer

   techwatchalert-agent relais etat shows the setting; relais desactiver removes it and forgets the authorisations received.

2. In Monitoring › Connectors, open the connector’s page, Configuration tab: at the How to reach the tool? step, choose Through an on-site agent, then the agent (with its Online or Offline state). Only agents of the project that are online, 1.3.0 or later and have on-site collection enabled can be chosen.

3. Enter the address as the agent sees it, the account and the secret, as with direct access. Self-signed certificate: enter its SHA-256 fingerprint (certificate details in your browser, or openssl x509 -noout -fingerprint -sha256).

4. Click Test and save: the test checks that the agent responds, then the authorisation reaches it within a minute and it checks the address. The Health card of the Results tab shows Relay ready once the agent has accepted it. Run a first synchronisation. Changing the agent or the address requires entering the secret again.

Caution

A new installation of the agent (re-enrolment) takes the setting from the command: add --relais again if the machine collects on site.

Displayed states

State	Meaning
Relay ready	The agent has accepted the authorisation; its expiry date is shown.
Authorisation being delivered	The agent will receive it at its next contact (within a minute if it is online).
On-site collection disabled on the machine	The agent refuses: run techwatchalert-agent relais activer on the machine. The authorisation is then sent again automatically.
Agent offline	The agent no longer contacts TechWatchAlert: collection resumes when it is back.
Agent connecting	The agent is online but its collection channel is not open yet (restart).

Common errors at synchronisation: unrecognised certificate (enter the certificate fingerprint), different fingerprint (certificate renewed: update the fingerprint), device unreachable from the agent (firewall between the agent’s machine and the device, address or port).

Security

• Local consent required, disabled by default; TechWatchAlert cannot enable it.
• A single address and port per connector, authorised by a signed instruction, time-limited and revocable; each authorisation and each withdrawal is recorded in the organisation’s audit log.
• Read only: the agent only relays reads (no deletion), never follows redirects nor uses a proxy, with responses limited to 16 MiB and a bounded timeout.
• A connector can only use an agent of its own project; an agent only receives requests from the connectors of its project.
• The connector’s credentials stay encrypted at TechWatchAlert; they only travel to the agent for the duration of a request and are never written on the machine.

Agent and endpoint managementInstall the agent, update it, its security.