Internal scanning

Scan an internal target through a Sentinel agent. Create the target, select the agent, set up authentication and know the limits.

Once a Sentinel agent is online, scanning an internal application works like scanning an external one: the same scan profiles, the same checks and the same finding format. What changes is the path the traffic takes.

Create an internal target

Register the target in Targets the same way as a public one, but point it at the internal address, for example https://internal-app.corp or http://10.20.30.40:8080. Use an address that resolves and is reachable from the host where the agent runs.

Select the Sentinel agent

Internal targets are scanned through an agent, never directly from the WASViking cloud. When you start the scan in Scans → New Scan, or when you set up a scheduled scan:

1. In Preferences → Scan Method, set Execution Path to Sentinel Tunnel (Internal).
2. Pick the agent in Sentinel Agent. Only agents that are online can run the scan.

Do not leave Execution Path on Direct (External) for an internal target. The cloud scanner cannot reach a private address. The full walkthrough with screenshots is in Set up the Sentinel tunnel.

Authentication

Internal apps usually require login. Pick the auth mode that matches your stack:

• Form Login with AI Autofill works for most server-rendered apps.
• Bearer is right for internal REST APIs with OIDC.
• Cookie is the escape hatch for opaque session systems.

Credentials are encrypted at rest, travel to the agent encrypted, are used in memory only, and are never written to disk on the host.

What happens during the scan

The Sentinel securely routes assessment traffic between the internal target and WASViking analyzers. The analysis runs on the WASViking side, so internal and external targets are assessed the same way, and the findings appear in the same Findings workflow as everything else, with the agent that carried the scan identified.

Limits

• One concurrent scan per agent by default. Configurable per agent. Larger hosts can run 2 to 4 in parallel.
• Bandwidth. Assessment traffic is made of many small requests. A 1 Mbps link is enough; a 10 Mbps link is comfortable.
• Scan duration. A scan is stopped after 12 hours. Most internal scans finish in 20 to 45 minutes.

Restricting agent reach

For sensitive networks, restrict what the agent can reach with host-side firewall rules. The agent honors these and reports unreachable hosts in the scan log.

A typical pattern:

• Allow the agent to reach the application subnet.
• Block the agent from reaching the management network.
• Block outbound traffic from the agent to anything other than sentinel.wasviking.com on port 443.

Multiple agents

You can install multiple agents per organization. Use this to:

• Cover network segments that cannot reach each other.
• Pair an agent per data center or cloud region.
• Keep scanning load away from production-critical hosts.

The portal shows all agents and their state, and you pick the agent for each scan.

What it does not do

Sentinel does not scan the host it runs on. For internal DAST it carries the assessment traffic; it does not provide host-based vulnerability scanning, endpoint protection or network discovery. For SBOM and secrets on the host, see the next pages in this section.

If a scan stays queued or the connection drops, see the troubleshooting section of Installing the Sentinel agent.