Smart Polling overview

Smart Polling actively contacts nodes to retrieve information for new nodes, and to enrich the information for existing nodes.

Smart Polling lets you create plans and define polling instructions for Guardian to use. For example, you can define:
  • Polling for specific nodes
  • Polling for specific times
  • The methods to use
    Note:
    For example, use the EtherNet/IP protocol to poll known programmable logic controller (PLC)s in the subnet 192.168.38.0/24 every hour.
Guardian uses the data that Smart Polling extracts to enrich its knowledge about the assets in the environment. For example:
  • PLC nodes polled using the EtherNet/IP protocol are enriched with information, such as vendor, device type, or serial number in Assets or Network
  • Windows computers polled using the Windows Remote Management (WinRM) protocol provide a list of the installed software in the Node points tab
  • Linux machines polled using secure shell (SSH) show in Assets and Network with the exact name of the distribution and their uptime

Active sensor

Smart Polling selects the sensor for execution based on the capture_device field of the polled node. If Arc detects the node, this field contains a reference to the Arc sensor, which is used to poll the node. Otherwise, the Guardian itself polls the node.

You can use the Guardian command-line interface (CLI) to modify the capture_device field to force Smart Polling from a specific Arc sensor. For example: vi node 192.168.1.1 capture_device arc[1e6a174c], where 192.168.1.1 is the node identifier (ID) and the value in brackets is the first eight characters of the Arc sensor ID.

The operating system (OS) of the sensor that polls the node decides which network interface to use based on the routing table. All Smart Polling strategies are based on the internet protocol (IP) protocol, which means that all routing decisions are delegated to the OS.