Profiles
Every host comes back with its address and name, operating system, device type, NIC vendor and MAC address, and its open services. On the same sweep the beacon reads the Wi-Fi around it for the Wireless Rogue Detector.
Identity you can trust
A device’s identity is fused from several signals and none is trusted alone. An SMB dialect does not make a host Windows, a NIC vendor shared by phones and IoT does not make it a phone, and a DNS answer only counts when it is a real DNS reply. That keeps phantom assets out of the inventory: a network that intercepts DNS cannot fill it with devices that do not exist.What it files
The beacon’s own detectors file what the sweep proves as internal findings for review: end-of-life operating systems and services, cleartext and remote-access services, exposed databases, weak TLS and certificates, and rogue Wi-Fi. They land in Needs Review with the external findings, tagged internal and filed under the beacon’s site.Internal Recon refuses to start until a discovery sweep has completed for that beacon. Liveness checks and the automatic single-device deep tasks do not count as the initial sweep.