Running Scans

TATER supports M365 cloud audits, Windows OS compliance scanning, and endpoint vulnerability scanning. This guide covers all scan types, execution methods, grouping, deduplication, and export.

Scan Overview

TATER evaluates compliance across three primary scan types:

Importing Scans

On the Scans page, press n while focus is outside text fields to open the same scan-file picker as Import Scan. Modifier-key combinations and typing in a field are left alone.

On hosted pages, use Import Scan to choose a JSON file. Development-only _latest_*.js auto-import files load only from an exact localhost or loopback host, or a local file: page, next to that HTML file. Hosted pages do not request them.

Scan results can be imported into TATER through several methods:

File Upload

Archive scan history

The per-row Delete scan permanently action is different: it keeps no recovery copy and cannot be restored. Its confirmation warns before deleting. Cancel and use Archive scan history… if you need recovery copies; that workflow selects the organization’s history, not just the row. A denied or failed deletion stays unconfirmed; reload history before retrying after a connection error.

Administrators can choose Archive scan history… on the Scans page after selecting one organization. TATER prepares a fixed selection, offers full JSON exports in parts, and requires the displayed scan count to be typed before continuing. You can explicitly continue without an export. Verify downloaded files separately; a browser download is not a verified backup.

Archiving stores full recovery copies before removing the selected revisions from active history and compliance calculations. New scans and records changed since selection are kept. Completed, skipped, and interrupted results are shown separately. Closing during a request stops further requests; the submitted batch may still finish. Reopen the dialog to resume, or start a fresh selection if it expires.

Open Settings > Recycle Bin > Archived scan history to download a recovery copy or restore it. Restore never overwrites an existing active scan. A recovery copy can also remain when removal was interrupted; its presence alone does not prove the scan was removed. No automatic purge is applied to these copies. Risk acceptances are kept.

Automatic Upload (Runbooks)

When using Azure Automation runbooks, scan results are automatically uploaded to the TATER API using the POST /scans/upload endpoint. The runbook authenticates using an API key configured in Azure Automation variables.

# Runbook auto-uploads results to TATER API
# No manual import needed when using Azure Automation
# Configure these Automation Variables:
#   ApiBaseUrl = "https://api.tatersecurity.com"
#   ApiKey     = "your-api-key"
#   OrganizationId = "your-org-id"

Automation Job Status

A newly requested Automation scan is tracked separately from other scans in the organization. Completed means its own report was accepted or its runbook reported completion. A separate scheduled or browser scan does not complete that job.

TimedOut means no matching report or progress update was observed for four hours. Check the Automation job output before requesting another scan; the timeout does not prove execution failed. A matching report that arrives later updates the job to Completed. Older job history can show a legacy inference note when execution could not be confirmed.

Server-Side Cloud Scan Trigger

If you have stored tenant credentials in TATER, you can trigger a cloud scan directly from the browser without needing Azure Automation:

1. Navigate to Scans and click Run Scan
2. Select the tenant credentials to use (configured in Settings > Tenants)
3. Choose the scan scope (full or specific applications)
4. Click Start Scan to begin the server-side scan
5. Monitor progress in the scan status panel; results appear automatically when complete

Scan Grouping

The Scans page always groups scans by type, with the following group order:

1. Cloud Runbook -- Scans from Azure Automation runbooks
2. Cloud -- Server-side or manual cloud scans
3. Endpoint -- MDE/Intune vulnerability scans
4. Speed Test -- Network speed test results from agents

Within each group, scans are sorted by the user-selected sort column (date, pass rate, etc.). The primary sort is always by type group, with user-selected sorting applied as a secondary sort within each group.

Each scan row displays the date (including time), scan type, machine name, framework, pass count, fail count, and compliance percentage.

Scan Comparison

Compare two scans side-by-side to identify what changed between scan cycles:

1. Select two scans using the checkboxes on the scan list
2. Click Compare in the toolbar
3. The comparison view shows controls that changed status (Pass to Fail, Fail to Pass, new controls, removed controls)
4. Use this to investigate compliance drift and understand the impact of configuration changes

Scan Deduplication

TATER automatically detects and consolidates duplicate scans at upload time. For repeated uploads from the same day, device and scan source:

• The system compares the complete summary, service plans, and every control with its evidence
• If the data matches, the existing scan record is updated with an incremented scanCount and updated lastScannedAt timestamp
• No new scan document is created, preventing database bloat from repeated identical scans
• The scan count badge shows how many times the same results were uploaded

M365 Compliance Audit

The M365 cloud audit evaluates your Microsoft 365 tenant for compliance with CIS Benchmarks, CISA SCuBA baselines, and DISA STIGs across seven cloud application areas, plus the endpoint and Intune benchmark sets.

Run a Cloud Scan

Configure tenant credentials in TATER, open Scans, and choose Run Scan. Select your tenant and product scope. The scan runs server-side and results appear in TATER when it completes. See Getting Started for your first scan.

For scheduled cloud scans and certificate-based Exchange scanning, configure Settings > Cloud Scanning using the Azure Automation guide. For recurring local endpoint scans, deploy the agent from Settings > Endpoint Agent using the Agent Deployment Guide.

Applications Scanned

These cloud application areas are evaluated by the Automation audit engine. The Control prefix column is the product code used on control IDs in the TATER catalog.

The Automation audit also covers Intune. Use the endpoint agent for recurring local OS and browser compliance scans.

Skip vs. Manual vs. Not Applicable

Three different statuses can be applied automatically when a control cannot be evaluated by the scanner, and they mean different things:

The Not Applicable flip is conservative: only license-gated controls the scanner couldn't evaluate are affected, a real Pass/Fail result is never changed, and if service-plan data is unavailable for the tenant nothing is flipped — no false N/A.

Endpoint Vulnerability Scanning

The endpoint scan collects vulnerability, software inventory, and compliance data from Microsoft Defender for Endpoint (MDE) and Microsoft Intune.

Data Sources

• MDE Devices: Full device inventory with health status, risk score, and exposure level
• MDE Vulnerabilities: Per-device CVE data queried individually to avoid memory limits
• MDE Software: Installed software inventory with weakness counts
• CISA KEV: Known Exploited Vulnerabilities catalog cross-referenced with MDE CVEs
• Intune Devices: Managed device compliance status and configuration profiles

Schedule

The Scan-Endpoints runbook runs daily at 3:00 AM ET via the daily-endpoint-scan Azure Automation schedule. Results are automatically uploaded to the TATER API.

Speed Test

The TATER Agent includes a built-in network speed test that measures download bandwidth. Results are uploaded alongside compliance scan data.

• Uses self-hosted test files at /Agent/speedtest/100mb.bin and 50mb.bin hosted on the TATER marketing SWA
• No dependency on third-party services (Cloudflare speed test caps at ~25MB)
• Results include download speed in Mbps and latency measurements
• Speed test scans appear in their own group on the Scans page

CSV Export

Export scan results to CSV format for use in external tools, SIEMs, or data warehouses:

1. Navigate to a specific scan's detail view
2. Click the Export CSV button in the toolbar
3. The CSV includes all control evaluations with: Control ID, Title, Status, Severity, Framework, Application, Description, and Remediation guidance

You can also export from the Controls page to get a cross-scan view of all controls and their current status.

Scan data freshness & source health

TATER tracks how recently each scan source last produced data, so old results don't quietly masquerade as current compliance. Each source is rated one of four states:

• Fresh — the source ran within its expected cadence.
• Aging — overdue but not yet stale; worth a look.
• Stale — well past cadence; treat its data as unreliable until you re-scan.
• Never — the runbook for this source has never completed. This means no scan has finished yet, not that a connector or Entra permission is missing — that is a different signal (see the connector-skip banner in the Dashboard guide).

Cadence SLAs by source:

To remediate an aging/stale/never source, trigger its runbook (or check the last job's status for a failure) — see Scan Scheduling below. The health of every source is available from the GET /scan-source-health API (Viewer and above) and the get_scan_source_health MCP tool, so an AI session can answer “why is my compliance data old?” directly.

Scan Scheduling

Configure recurring scan schedules using the Azure Automation scheduling system:

TATER also supports server-side scan scheduling through the GET/POST /scan-schedule API endpoints for organizations that prefer to manage schedules within the TATER application.