Running Scans

TATER supports M365 cloud audits, Windows OS compliance scanning, and endpoint vulnerability scanning. This guide covers all scan types, execution methods, grouping, deduplication, and export.

Scan Overview

TATER evaluates compliance across three primary scan types:

Importing Scans

Scan results can be imported into TATER through several methods:

File Upload

Automatic Upload (Runbooks)

When using Azure Automation runbooks, scan results are automatically uploaded to the TATER API using the POST /scans/upload endpoint. The runbook authenticates using an API key configured in Azure Automation variables.

# Runbook auto-uploads results to TATER API
# No manual import needed when using Azure Automation
# Configure these Automation Variables:
#   ApiBaseUrl = "https://api.tatersecurity.com"
#   ApiKey     = "your-api-key"
#   OrganizationId = "your-org-id"

Server-Side Cloud Scan Trigger

If you have stored tenant credentials in TATER, you can trigger a cloud scan directly from the browser without needing Azure Automation:

1. Navigate to Scans and click Run Scan
2. Select the tenant credentials to use (configured in Settings > Tenants)
3. Choose the scan scope (full or specific applications)
4. Click Start Scan to begin the server-side scan
5. Monitor progress in the scan status panel; results appear automatically when complete

Scan Grouping

The Scans page always groups scans by type, with the following group order:

1. Cloud Runbook -- Scans from Azure Automation runbooks
2. Cloud -- Server-side or manual cloud scans
3. Endpoint -- MDE/Intune vulnerability scans
4. Speed Test -- Network speed test results from agents

Within each group, scans are sorted by the user-selected sort column (date, pass rate, etc.). The primary sort is always by type group, with user-selected sorting applied as a secondary sort within each group.

Each scan row displays the date (including time), scan type, machine name, framework, pass count, fail count, and compliance percentage.

Scan Comparison

Compare two scans side-by-side to identify what changed between scan cycles:

1. Select two scans using the checkboxes on the scan list
2. Click Compare in the toolbar
3. The comparison view shows controls that changed status (Pass to Fail, Fail to Pass, new controls, removed controls)
4. Use this to investigate compliance drift and understand the impact of configuration changes

Scan Deduplication

TATER automatically detects and consolidates duplicate scans at upload time. When a scan with identical results is uploaded:

• The system compares the scan summary plus 100 randomly-sampled controls from the existing scan
• If the data matches, the existing scan record is updated with an incremented scanCount and updated lastScannedAt timestamp
• No new scan document is created, preventing database bloat from repeated identical scans
• The scan count badge shows how many times the same results were uploaded

M365 Compliance Audit

The M365 cloud audit evaluates your Microsoft 365 tenant for compliance with CIS Benchmarks, CISA SCuBA baselines, and DISA STIGs across eight application areas.

Running the Audit Script

# Basic usage - interactive authentication
.\M365-ComplianceAudit.ps1 -TenantId "your-tenant-id" -OutputDir "C:\ScanResults"

# App-only authentication with certificate
.\M365-ComplianceAudit.ps1 -TenantId "your-tenant-id" -AppClientId "app-client-id" -CertThumbprint "thumbprint" -OutputDir "C:\ScanResults"

# Scope to specific applications
.\M365-ComplianceAudit.ps1 -TenantId "your-tenant-id" -Applications "EXO,SPO,DEF" -OutputDir "C:\ScanResults"

Script Parameters

Applications Scanned

Endpoint Vulnerability Scanning

The endpoint scan collects vulnerability, software inventory, and compliance data from Microsoft Defender for Endpoint (MDE) and Microsoft Intune.

Data Sources

• MDE Devices: Full device inventory with health status, risk score, and exposure level
• MDE Vulnerabilities: Per-device CVE data queried individually to avoid memory limits
• MDE Software: Installed software inventory with weakness counts
• CISA KEV: Known Exploited Vulnerabilities catalog cross-referenced with MDE CVEs
• Intune Devices: Managed device compliance status and configuration profiles

Schedule

The Scan-Endpoints runbook runs daily at 3:00 AM ET via the daily-endpoint-scan Azure Automation schedule. Results are automatically uploaded to the TATER API.

Speed Test

The TATER Agent includes a built-in network speed test that measures download bandwidth. Results are uploaded alongside compliance scan data.

• Uses self-hosted test files at /Agent/speedtest/100mb.bin and 50mb.bin hosted on the TATER marketing SWA
• No dependency on third-party services (Cloudflare speed test caps at ~25MB)
• Results include download speed in Mbps and latency measurements
• Speed test scans appear in their own group on the Scans page

CSV Export

Export scan results to CSV format for use in external tools, SIEMs, or data warehouses:

1. Navigate to a specific scan's detail view
2. Click the Export CSV button in the toolbar
3. The CSV includes all control evaluations with: Control ID, Title, Status, Severity, Framework, Application, Description, and Remediation guidance

You can also export from the Controls page to get a cross-scan view of all controls and their current status.

Scan Scheduling

Configure recurring scan schedules using the Azure Automation scheduling system:

TATER also supports server-side scan scheduling through the GET/POST /scan-schedule API endpoints for organizations that prefer to manage schedules within the TATER application.