Adding a host
From the UI
- Navigate to Hosts in the left sidebar.
- Click Add Host.
- Fill in the details:
| Field | Required | Example |
|---|---|---|
| Hostname | Yes | web-01 |
| IP Address | Yes | 192.168.1.10 |
| SSH Port | Yes | 22 |
| Display Name | No | Web Server 01 |
| Operating System | No | RHEL 9 |
| Environment | No | production |
- Click Save.
Bulk import
- Navigate to Hosts and click Bulk Import.
- Download the CSV template.
- Fill in the template with your host data.
- Upload the CSV file.
- Review the auto-detected field mappings.
- Confirm the import.
SSH credentials
OpenWatch connects to hosts over SSH. No agent is installed on target hosts.| Method | When to use |
|---|---|
| SSH Key (recommended) | Paste or upload the private key. Stored encrypted. |
| Password | Enter the SSH password. Stored encrypted with AES-256-GCM. |
| System Default | Uses the credential configured in Settings > System Credentials. |
Credential security
All credentials are encrypted with AES-256-GCM before being stored in the database. Decryption happens only at scan time, in memory. Plaintext credentials are never written to disk or logs.Host groups
Host groups let you organize hosts into logical collections for group-level compliance reporting and batch scanning.Creating a group
- Navigate to Host Groups in the sidebar.
- Click Create Group.
- Enter a name, description, OS family, and compliance framework.
- Click Save.
Assigning hosts
- Open the group detail page.
- Click Add Hosts.
- Select hosts from the list.
- Click Confirm.
Smart group creation
Select multiple hosts and click Smart Group. OpenWatch analyzes their OS, architecture, and compliance profile to recommend group settings automatically.Group scanning
From the group detail page, click Scan Group to start a compliance scan for all hosts in the group simultaneously.Host discovery
OS detection
OpenWatch automatically detects the operating system during scans. A scheduled task runs daily at 02:00 UTC to discover the OS for all active hosts not yet identified.Connectivity monitoring
Host connectivity is checked every 30 seconds. Each check verifies ICMP reachability, SSH port availability, and SSH authentication. Host status (online, offline, degraded) updates in the host list.Server intelligence
During compliance scans, OpenWatch collects detailed information about each host. Available on the host detail page under the Intelligence tab.| Category | What it contains |
|---|---|
| Packages | Installed packages, versions, sources |
| Services | Running services, listening ports, enabled state |
| Users | User accounts, groups, shell, last login |
| Network | Interfaces, IP addresses, firewall rules |
Remediation
OpenWatch can automatically fix compliance findings through Kensa’s 23 remediation mechanisms. All changes are made over SSH.What remediation can fix
| Category | Examples |
|---|---|
| Boot configuration | GRUB settings, boot parameters |
| Authentication | PAM modules, password policies |
| Filesystem | fstab mount options, file permissions |
| Kernel | sysctl parameters, module blacklisting |
| Services | systemd service management, cron restrictions |
| Audit | auditd rules, log configuration |
| Network | SSH daemon settings, firewall rules |
Starting a remediation
- Navigate to the host detail page and view scan results.
- Select the failing findings you want to remediate (use checkboxes).
- Click Remediate Selected.
- Review the proposed changes.
- Click Start Remediation to confirm.
- Select findings and click Request Remediation.
- Enter a justification.
- An admin reviews and approves the request.
- Once approved, the remediation executes automatically.
Monitoring progress
Track remediation progress on the host detail page under the Remediation tab:- Job status: pending, running, completed, failed, partial, cancelled
- Progress percentage: how many rules have been processed
- Per-rule results: which fixes succeeded, failed, or were skipped
- Execution log: timestamps and details for each step
Rollback
Pre-state snapshots are captured automatically before any remediation changes.- Go to the Remediation tab on the host detail page.
- Find the remediation job.
- Click Rollback.
- Enter a reason (logged for audit purposes).
- Click Confirm Rollback.
scan:rollback permission).
After a rollback completes, run a follow-up compliance scan to verify the host returned to its previous state.
Required permissions
| Operation | Minimum Role |
|---|---|
| View hosts | GUEST |
| Add / edit / delete hosts | SECURITY_ANALYST |
| Bulk import / export | SECURITY_ADMIN |
| Start remediation | SECURITY_ADMIN |
| Approve remediation | SUPER_ADMIN |
| Rollback remediation | SECURITY_ADMIN |
| View server intelligence | SECURITY_ANALYST |
| Manage host groups | SECURITY_ANALYST |
Best practices
- Test credentials before scanning. Use the Test Connection button to confirm SSH access.
- Use SSH keys, not passwords. Key-based authentication is more secure and reliable.
- Start remediation on a single host. Test changes on one host before applying to a group.
- Review findings before remediating. Understand what each rule checks and what the fix changes.
- Monitor compliance score after remediation. Force a scan for immediate results.
- Use groups for consistent scanning. Hosts in the same group share OS family, framework, and scan schedule.