Scan Triggers and Timing

PDQ Connect can perform actions and gather information on managed endpoints. The agent gathers information using scans, which occur on various timed schedules, are triggered by specific events, or can be initiated manually by the user. This article explains what triggers a scan and what information is gathered by each scan type.

Automatic Scan Types and Timing

The basic behavior of scanners in PDQ Connect is as follows. 

• Full inventory scans are scheduled to run every 12 to 14 hours
  • Full Inventory scans are used to populate most of the information that appears on the Device tabs, including the device information automatically gathered by the platform from all devices, as well as user-created custom scanners. A complete list of scan data appears below.
  • The timing is variable because the platform prioritizes those devices which have the oldest scan data. 
• The check-in scanner runs every 7.5 minutes while a device is online

Manual scans, deployments, and commands also trigger immediate scan activity.

Scan Triggers

The following events trigger scans on a device:

Device Comes Online

Each time a device comes online, a lightweight check-in scan runs immediately, which performs these actions:

• Updates Online status, Current user, Boot time, and Remote desktop settings

• If the device was offline for more than 2 hours, any scanners that have not run within the last 12 hours also run automatically during the check-in scan. 

Device Remains Online

While a device remains connected, the lightweight check-in scan repeats every 7.5 minutes.

User actions

• Package deployment When a user deploys a package to a device. 
• Manual scan: 
  • On the Devices page, select one or more devices, and click Actions | Scan.
    
  • On a device page, click the kebab menu (⁝) and click Scan device. 
    
• Processes and Services
  After you start or stop an item in the Processes or Services tabs, the relevant scanners for that information will run. 

Scan Data

This section details what information is gathered in each scan type. 

Full Inventory Scans

Full Inventory scans are used to populate most of the information that appears on the Device tabs, as listed below. 

Note that this includes all tabs which are populated with data from user-created Custom scanners, including File and Folder scanners, Registry scanners, and PowerShell scanners.

System information
Applications
Updates
Drivers
Features
Services
Processes
Networking
Active Directory
Vulnerabilities
Custom scanner data