Once hosts are added to Sandfly, you can see a listing of them under the host view screen. Sandfly will show you the first time this host was seen (e.g. when it was added), the last time it was seen, the last IP address it was using, and other details about authentication status, credentials used, host_id, etc.


Below you can see a list of active, inactive, and offline hosts. Active hosts are those that Sandfly was able to successfully authenticate to and inventory. Inactive hosts are those that had a problem authenticating or were unreachable for other reasons. Offline marked hosts were once active, but have not been accessed by Sandfly in the last 24 hours. This offline state could be set for various reasons, so it is good to check as to why. Most typically it is because the host is no longer in any scan schedule, or its schedule(s) may be paused or running in cycles greater than 24 hours.


Sandfly Host Listing

Sandfly Host Listing


Viewing Hosts Details

You can see details about the host by simply clicking on it. A break out of the details will appear like below.


Sandfly Host Details

Sandfly Host Details


Raw data about the host will have many more details in JSON format. You scan see this data by selecting the Raw Host Data tab.


Sandfly Raw Host Data View

Sandfly Raw Host Data View


Viewing Inactive Hosts

Hosts that could not be logged into for whatever reason will show up with a grey question mark for the status icon and circle-backslash icon in the Active column. The Auth Status column will tell you why the host could not be added to Sandfly.


Sandfly Inactive Hosts

Sandfly Inactive Hosts


Host View Top Bar

The top bar for the host view contains Filters, Columns, Download CSV, and Presets buttons. These buttons give you the ability to quickly narrow down your search on large host sets and get additional information.


Host View Top Bar

Host View Top Bar


Host Filter

The Filters option allows you to quickly build filters to narrow down the hosts in the view. You can for instance build a filter for hosts with a good Auth Status, that are running an OS that starts with "U", and has an uptime of 90+ days by combining options like the example below. Use other combinations of these and other parameters as needed for showing the desired entries.


Filtering Down Hosts

Filtering Down Hosts


Column Selector

The Hosts view has many columns that can be displayed or hidden depending on your preference. Simply toggle what you want to see or not in the Columns' pop-up box.


Host Column Selection

Host Column Selection


Export

You can select hosts and export the columns in the Comma Separated Values (CSV) format with the Download CSV button. Visible column data will be prepared and downloaded via your browser.


Download CSV

Presets

Presets have common options to use with a filter. In the Host View, the presets allow you to quickly see all active hosts or all inactive hosts. This can be used to quickly purge the system of systems that are not responding. The preset button when clicked will show the below options.


Active and Inactive Presets

Active and Inactive Presets


Deleting Hosts

Hosts that are inactive or you do not want monitored any longer should be deleted. All hosts in the system count towards your active license total so keeping inactive hosts is wasteful.


WARNING: Inactive Hosts Consume License Keys!

Having inactive hosts still counts towards your total license number. So for instance if you have a license for 1000 systems and you have 500 active and 500 inactive hosts, then your have reached your license total. You should delete the 500 inactive hosts to free up slots for legitimate systems you want monitored.


Below we used the "Inactive Only" filter preset to list all inactive hosts. Then we selected them all by clicking on the checkbox in the header row of the table. The quantity of selected entries is shown for your convenience at the bottom left corner of the table.


Selecting Inactive Hosts

Selecting Inactive Hosts


To delete hosts, simply click on the Delete Selected button. It is important to note that all results data for any removed hosts that were active at some point will be scheduled for deletion in the background.


NOTE: Deleting a Host Also Deletes All of its Results Data

All results data stored in Sandfly will also be removed when a host is deleted. Make a copy of any host data that you may want to store before deleting a host.



Previous
Previous Article:

Next Article:
Next