Once hosts are added to Sandfly, you can see a listing of them under the host view screen. Sandfly will show you the first time this host was seen (e.g. when it was added), the last time it was seen, the last IP address it was using, and other details about authentication status, credentials used, host_id, etc.
Below you can see a list of active, inactive, and offline hosts. Active hosts are those that Sandfly was able to successfully authenticate to and inventory. Inactive hosts are those that had a problem authenticating or were unreachable for other reasons. Offline marked hosts were once active, but have not been accessed by Sandfly in the last 24 hours. This offline state could be set for various reasons, so it is good to check as to why. Most typically it is because the host is no longer in any scan schedule, or its schedule(s) may be paused or running in cycles greater than 24 hours.
Sandfly Host Listing
Viewing Hosts Details
You can see details about the host by simply clicking on it. A break out of the details will appear like below.
Sandfly Host Details
Raw data about the host will have many more details in JSON format. You scan see this data by selecting the Raw Host Data tab.
Sandfly Raw Host Data View
Viewing Inactive Hosts
Hosts that could not be logged into for whatever reason will show up with a grey question mark for the status icon and circle-backslash icon in the Active column. The Auth Status column will tell you why the host could not be added to Sandfly.
Sandfly Inactive Hosts
Host View Top Bar
The top bar for the host view contains Filters, Columns, Download CSV, and Presets buttons. These buttons give you the ability to quickly narrow down your search on large host sets and get additional information.
Host View Top Bar
Host Filter
The Filters option allows you to quickly build filters to narrow down the hosts in the view. You can for instance build a filter for hosts with a good Auth Status, that are running an OS that starts with "U", and has an uptime of 90+ days by combining options like the example below. Use other combinations of these and other parameters as needed for showing the desired entries.
Filtering Down Hosts
Column Selector
The Hosts view has many columns that can be displayed or hidden depending on your preference. Simply toggle what you want to see or not in the Columns' pop-up box.
Host Column Selection
Export
You can select hosts and export the columns in the Comma Separated Values (CSV) format with the Download CSV button. Visible column data will be prepared and downloaded via your browser.
Presets
Presets have common options to use with a filter. In the Host View, the presets allow you to quickly see all active hosts or all inactive hosts. This can be used to quickly purge the system of systems that are not responding. The preset button when clicked will show the below options.
Active and Inactive Presets
Deleting Hosts
Hosts that are inactive or you do not want monitored any longer should be deleted. All hosts in the system count towards your active license total so keeping inactive hosts is wasteful.
WARNING: Inactive Hosts Consume License Keys! Having inactive hosts still counts towards your total license number. So for instance if you have a license for 1000 systems and you have 500 active and 500 inactive hosts, then your have reached your license total. You should delete the 500 inactive hosts to free up slots for legitimate systems you want monitored.
Below we used the "Inactive Only" filter preset to list all inactive hosts. Then we selected them all by clicking on the checkbox in the header row of the table. The quantity of selected entries is shown for your convenience at the bottom left corner of the table.
Selecting Inactive Hosts
To delete hosts, simply click on the Delete Selected button. It is important to note that all results data for any removed hosts that were active at some point will be scheduled for deletion in the background.
NOTE: Deleting a Host Also Deletes All of its Results Data All results data stored in Sandfly will also be removed when a host is deleted. Make a copy of any host data that you may want to store before deleting a host.
 | Previous Article: | Next Article: |  |