Linux
Windows
Root required
| Name | Summary | Dependencies | Status |
|---|---|---|---|
| arp | ARPModule reads internal ARP table to find network neighbors. | ping | |
| chassis | ChassisModule fills host chassis information | host-basic | |
| docker | DockerModule retrieves information about docker containers. | host-network, tcp-scan | |
| dpkg | DPKGModule reads package information from the dpkg package manager. | host-basic, netstat | |
| fingerprint | FingerprintModule attempts to match the local host against machines already discovered in the shared database. | |
|
| host-basic | HostBasicModule retrieves basic information about the host: hostid, architecture, platform, distribution, version and uptime | fingerprint | |
| host-cpu | HostCPUModule retrieves host CPU info: model, vendor and the number of cores. | host-basic | |
| host-disk | HostDiskModule retrieves basic information about disk: name, model, size, type, controller and partitions. | host-basic | |
| host-gpu | HostGPUModule retrieves basic information about GPU: index, vendor and product name. | host-basic | |
| host-network | HostNetworkModule retrieves basic network information about the host. | host-basic | |
| ja4 | JA4Module attempts JA4, JA4S and JA4X fingerprinting | tls | |
| local-users | LocalUsersModule lists all local user accounts on the system. | host-basic | |
| macvendor | MACVendorModule resolves manufacturer from MAC addresses. | arp | |
| msi | MSIModule creates models.Packages instance from the windows registry | host-basic | |
| netstat | NetstatModule retrieves active connections. | local-users, tcp-scan | |
| ping | PingModule pings local networks to discover new hosts. | host-network | |
| reverse-lookup | ReverseLookupModule tries to get a hostname attached to a local IP address | arp | |
| rpm | RPMModule reads package information from the rpm package manager. | host-basic, netstat | |
| saas | SaaSModule identifies SaaS applications from discovered endpoints. | tls, ja4 | |
| standard-protocol | StandardProtocolModule fills standard protocol information for endpoints. | netstat | |
| tcp-scan | TCPScanModule tries to connect to neighbor TCP ports. | arp | |
| tls | TLSModule enriches TCP endpoints with TLS certificate information. | tcp-scan, netstat | |
| zypper | ZypperModule reads package information from the zypper package manager. | host-basic, netstat | |