Smart Polling overview

Smart Polling actively contacts nodes to retrieve information for new nodes, and to enrich the information for existing nodes.

Smart Polling lets you create plans and define polling instructions for Guardian to use. For example, you can define:
  • Polling for specific nodes
  • Polling for specific times
  • The methods to use
    Note:
    For example, use the EtherNet/IP protocol to poll known programmable logic controller (PLC)s in the subnet 192.168.38.0/24 every hour.
Guardian uses the data that Smart Polling extracts to enrich its knowledge about the assets in the environment. For example:
  • PLC nodes polled using the EtherNet/IP protocol are enriched with information, such as vendor, device type, or serial number in Assets or Network
  • Windows computers polled using the Windows Remote Management (WinRM) protocol provide a list of the installed software in the Node points tab
  • Linux machines polled using secure shell (SSH) show in Assets and Network with the exact name of the distribution and their uptime

Active sensor

Smart Polling on Guardian selects the sensor or sensors for execution based on the capture_devices field of the polled node. Smart Polling will engage the corresponding sensors. When at least one successful execution occurs from a sensor, Smart Polling remembers to use that sensor in future executions. If Smart Polling records no successful executions for more than a week, it will fall back to engaging the sensors recorded in the capture_devices field of the node.

To add a sensor to the applicable sensors for a node, you can use the Guardian command-line interface (CLI) to modify the capture_devices field, by adding the capture device. For example, vi node 192.168.1.1 capture_device arc[1e6a174c], where 192.168.1.1 is the node identifier (ID) and the value in brackets is the first eight characters of the Arc sensor's ID.

The operating system (OS) of the sensor that polls the node decides which network interface to use based on the routing table. All Smart Polling strategies are based on the internet protocol (IP), which means that all routing decisions are delegated to the OS.