.png)
Blog
Insights & updates from our experts
Discovery Credential Sets
Give the hub a way to read your devices, and choose the right type for each protocol.
A credential set holds the secrets a hub presents to a device so it can read that device. Secrets are encrypted for the hub and are never shown again after you save them. A credential set belongs to one protocol, and the protocol cannot be changed after it is saved.
Create a credential set
- Open the Credential Sets tab, or the setup checklist step Add a Credential Set.
- Answer How should the hub read your devices? by choosing SNMP, WMI or SSH.
- For SNMP, choose the version. For SSH, choose how the hub logs in. WMI has a single type.
- Fill in the fields described below and select Save Credential Set.
Fields marked with an asterisk in the product are required. Use the least privilege that still lets the hub read the device.
SNMP
| Type | When to choose it | Fields |
|---|---|---|
| SNMP v2c (recommended) | Most devices still support it. Authenticates with a community string. | Community string *, Port (161) |
| SNMP v1 | Only for devices too old to offer anything else. | Community string *, Port (161) |
| SNMP v3 | Adds a per-user login and optional encryption. The only version with per-user authentication. | Username *, Authentication protocol, Authentication password, Privacy protocol, Privacy password, Context, Port (161) |
Many devices ship with the community string public. Change it where you can, and use a string scoped to the hub's address. For SNMP v3, use the same security level (no authentication, authentication, or authentication with privacy) that the device requires.
SSH
| Type | When to choose it | Fields |
|---|---|---|
| SSH password (recommended) | Logs in with a username and password. | Username *, Password *, Port (22) |
| SSH key | Logs in with a private key, optionally protected by a passphrase. | Username *, Private key *, Passphrase, Port (22) |
The hub runs a fixed set of read-only commands and does not open a terminal. Where a command needs elevated rights it uses sudo without a password prompt, so grant the account passwordless sudo for only the commands discovery needs.
WMI
| Field | Purpose |
|---|---|
| Username *, Password * | A domain or local account that may query WMI on the target |
| Domain | The account's domain. Leave empty for a local account. |
| Transport security | require_encrypted makes the hub use only a verified encrypted channel and report a host that cannot meet it. allow_cleartext permits fallback. |
| CA certificate | The certificate authority that signed the targets' WinRM HTTPS certificates, when it is not already trusted by the hub |
| Authentication mechanism | automatic (default), kerberos or ntlm |
| KDC, Realm | Domain controllers and realm for Kerberos sign-in, when the hub cannot find them itself |
| Credential source | Read each device's local administrator password from LAPS in a directory instead of using one shared password. Needs the directory address (an ldaps URL), a reading account and its password, and optionally a base DN. When used, the shared Password and Domain fields are not needed. |
Lockout protection
If a credential is refused repeatedly, the hub stops offering it so a wrong password does not lock an account across your estate. Devices that were not attempted for this reason are reported with the status credentials_unavailable. Correct the credential, test it on one device, then scan the range. The credential set record holds the lockout protection settings.
Open Modal