payload: {"action":"created","issue":{"url":"https://api.github.com/repos/natlas/natlas/issues/231","repository_url":"https://api.github.com/repos/natlas/natlas","labels_url":"https://api.github.com/repos/natlas/natlas/issues/231/labels{/name}","comments_url":"https://api.github.com/repos/natlas/natlas/issues/231/comments","events_url":"https://api.github.com/repos/natlas/natlas/issues/231/events","html_url":"https://github.com/natlas/natlas/issues/231","id":520367937,"node_id":"MDU6SXNzdWU1MjAzNjc5Mzc=","number":231,"title":"Possibility to schedule / throttle scans","user":{"login":"Beverdam","id":3942720,"node_id":"MDQ6VXNlcjM5NDI3MjA=","avatar_url":"https://avatars0.githubusercontent.com/u/3942720?v=4","gravatar_id":"","url":"https://api.github.com/users/Beverdam","html_url":"https://github.com/Beverdam","followers_url":"https://api.github.com/users/Beverdam/followers","following_url":"https://api.github.com/users/Beverdam/following{/other_user}","gists_url":"https://api.github.com/users/Beverdam/gists{/gist_id}","starred_url":"https://api.github.com/users/Beverdam/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Beverdam/subscriptions","organizations_url":"https://api.github.com/users/Beverdam/orgs","repos_url":"https://api.github.com/users/Beverdam/repos","events_url":"https://api.github.com/users/Beverdam/events{/privacy}","received_events_url":"https://api.github.com/users/Beverdam/received_events","type":"User","site_admin":false},"labels":[{"id":926911309,"node_id":"MDU6TGFiZWw5MjY5MTEzMDk=","url":"https://api.github.com/repos/natlas/natlas/labels/enhancement","name":"enhancement","color":"a2eeef","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2019-11-09T09:34:57Z","updated_at":"2019-11-09T10:02:27Z","closed_at":null,"author_association":"NONE","body":"**Is your feature request related to a problem?**\r\nCurrently, there is no (obvious) way to throttle the scans or schedule the scans performed by Natlas. This leads to pollution on web-facing services when scanning a large amount of IP's that you own.\r\n\r\n**Describe the feature you'd like**\r\nI would like to have the possibility to throttle and schedule scans performed by Natlas agents.\r\n\r\n**Have you considered alternative ways to get this feature**\r\nNo.\r\n\r\n**Additional context**\r\nPractical example: with the release of the BlueKeep exploit, it is becoming more and more clear that having RDP enabled and facing the public internet is a Very Bad Idea (tm). Natlas could have helped quickly in identifying which machines have this port open. \r\n"},"comment":{"url":"https://api.github.com/repos/natlas/natlas/issues/comments/552084916","html_url":"https://github.com/natlas/natlas/issues/231#issuecomment-552084916","issue_url":"https://api.github.com/repos/natlas/natlas/issues/231","id":552084916,"node_id":"MDEyOklzc3VlQ29tbWVudDU1MjA4NDkxNg==","user":{"login":"Beverdam","id":3942720,"node_id":"MDQ6VXNlcjM5NDI3MjA=","avatar_url":"https://avatars0.githubusercontent.com/u/3942720?v=4","gravatar_id":"","url":"https://api.github.com/users/Beverdam","html_url":"https://github.com/Beverdam","followers_url":"https://api.github.com/users/Beverdam/followers","following_url":"https://api.github.com/users/Beverdam/following{/other_user}","gists_url":"https://api.github.com/users/Beverdam/gists{/gist_id}","starred_url":"https://api.github.com/users/Beverdam/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Beverdam/subscriptions","organizations_url":"https://api.github.com/users/Beverdam/orgs","repos_url":"https://api.github.com/users/Beverdam/repos","events_url":"https://api.github.com/users/Beverdam/events{/privacy}","received_events_url":"https://api.github.com/users/Beverdam/received_events","type":"User","site_admin":false},"created_at":"2019-11-09T10:02:27Z","updated_at":"2019-11-09T10:02:27Z","author_association":"NONE","body":"Response I got from the developer through a different channel:\r\n\r\nThere's no concept of \"interval between scans\" or \"regularly scheduled scans\" right now in natlas. The idea is that it just runs continuously. Forever. If you want it slower, you can adjust the number of total agent threads working to a lower value. If you want it faster, you can increase the number of total agent threads (via adding more threads to existing agents or adding additional agents).\r\n\r\nAt the moment there isn't much planned in the way of timeboxing or scheduling scans of specific hosts or scopes. The idea is that by just always doing scans, you'll be able to identify things at the scale that you desire. For example, if we added a feature to say \"scan a (large) range every night at 0300\" and then the next night at 0300 shows up and you've not finished scanning the range from the night before, do you restart scanning that range or do you queue it up?\r\n\r\nI can tell you now that setting an interval between all scans will almost certainly not make it into natlas, as the idea is continuous scanning of ranges vs scheduled scans of ranges. The system will scan exactly as fast as the number of worker threads across agents will allow. As soon as a worker thread is free to get new work, it does. The 60 second value you're seeing is probably related to the average time it takes nmap to scan a given address and whether or not you're using -Pn.\r\n\r\nAs of now, scale the number of agents you have doing work until you're getting results approximately as often as you'd like. The targets are selected in a pseudorandom cyclical order, so there is always variance in distance between two scans. Less agents and less threads means slower turnaround time. You'll have to experiment with how many threads achieves the frequency you want. In the meantime, document the IP addresses of your agents and make them known inside the company to whoever looks at web server logs so that they can easily be filtered."}}
other: {"actor":{"display_login":"Beverdam"}}