Scheduling and retention

Ctadel re-runs the inventory of your accounts at a fixed interval, purges closed findings after a period you choose, and rebuilds the dashboard history from the dates of the findings. The settings live under "Settings", tab "General"; reading them requires read:settings, changing them update:settings.

Scheduled scans

The "Scanning Configuration" card holds the "Automatic Scanning" switch, on when the instance is created, and the "Scan Frequency" field, in hours between two full scans, 24 by default. The server accepts a value from 12 to 168 hours.

As soon as the last full scan is older than the chosen frequency, the instance starts a new one, with source "Auto-Scheduled". A full scan goes through three phases, shown in the card and in the "Scan running" header pill: "inventory N/M accounts", "evaluating rules", then "dispatching workers" (handing the content analyses to the disk, bucket, database and cluster scanners). Findings from these analyses keep arriving for a few minutes after the announced end. A changed setting is taken into account within the minute after it is saved.

The card also shows "Last full scan: ..." and, under "Full scan", the source and date of the last run, with a possible "Warning: ...".

On-demand scans

The "Scan now" button of the same card starts a full scan with source "Manual-Trigger". Only one full scan runs at a time: while one is in progress, the button answers "A full scan is already running." At the end, the application shows "Full scan completed" ("Inventory refreshed, rules evaluated. Worker findings keep arriving for a few minutes.") and, when the "Email when a full scan completes" switch is on, sends a summary to the people holding the "Global Admin" role. Notification channels receive the scan event when they asked for it; see Notifications.

A Kubernetes cluster is re-scanned separately from "Integrations", "Kubernetes", with the "Scan Now" and "Rescan" buttons.

Retention of closed findings

The "Data Retention" card holds the "Retention Period" field, in days: 90 by default, between 7 and 3650. Once a day, the instance deletes the closed findings whose closure (or, failing that, last observation) is older than this period, together with their event history.

Findings	Fate after the period
Resolved, fixed, false positives, revoked	Deleted
Open	Kept without limit
Ignored or accepted	Kept as long as they are not resolved
Detections on activity logs (CDR)	Deleted by event date

A finding ignored with an expiry date is reopened at that time, through an hourly check, and becomes an open finding again.

The audit log

Audit log entries are kept for 365 days, whatever the finding retention period, and purged once a day as well. This duration cannot be set from the interface. See Audit log.

Dashboard history

The dashboard curves (open and closed findings, breakdown by severity) cover the last 30 days. On each load, the series is recomputed from the dates carried by the findings, discovery date and closure date. A finding counts as open on a given day when it was discovered on or before that day and not yet closed; closures accumulate. Findings discovered before the window enter the starting point.

Limitations

• The frequency is set in hours elapsed since the last scan; no fixed time of day, no calendar, no per-account frequency.
• The "Scan Frequency" field of the interface refuses a value below 24 hours, while the server accepts 12.
• The retention period is the same for every finding type, and the card's note ("Findings older than N days are permanently deleted.") does not say that only closed findings are concerned.
• A purged finding also disappears from the dashboard history, which has no memory of its own.
• The history is limited to 30 days and cannot be exported.
• The audit log retention is fixed.
• Backups of the instance are Ctadel's responsibility; see Backups and recovery.