Recurring internal scans + scan windows

What it is

Three scheduling features that turn the agent from a one-shot scanner into an always-on internal surface monitor:

• Recurring scans: each internal CIDR target has a scan_interval. A cloud-side scheduler enqueues a fresh discover task whenever next_scan_at falls due, with ±10% jitter so a fleet of agents doesn’t clock-align.
• Scan windows: per-target start/end minutes (UTC), so you can restrict probing to “02:00–06:00 customer-local” only. Same- day and cross-midnight windows both supported.
• Reprobe-gone: when any service flips to gone after a scan, the parent target’s next_scan_at gets pulled forward to ~4 hours, so disappearance is confirmed quickly instead of waiting a full day.

What it produces

• A continuous stream of discover tasks the agent claims via long-poll
• Per-target last_scanned_at and next_scan_at you can read from the Targets page

What to use it for

• Maintaining live coverage on a customer’s internal network without operator clicks
• Compliance: “we scan PCI scope every 4 hours, during the 02:00 customer-local maintenance window only”
• Catching ephemeral services (a worker that runs for an hour every night) by aligning the scan window with their lifetime

Why it matters

Continuous coverage is the difference between “we have an internal-agent product” and “we have an internal-agent product that’s still useful three months after install.” Manual rescan clicks scale to demos; recurring scans scale to a fleet.

Why it’s valuable

• One scheduler, two surfaces. External targets use the cloud scheduler; internal targets use the agent scheduler. Same scan_interval field, same UX, no surprises.
• Maintenance windows. Stay out of the customer’s working hours unless they ask otherwise.
• Reprobe-gone reduces stale data. Internal services often come and go. The 4 h pull-forward confirms the disappearance fast.

How to use it

On any internal_cidr target:

• scan_interval (seconds): defaults to 86400 (1 day). Tune via the target edit drawer.
• scan_window_start_min + scan_window_end_min (minutes from midnight UTC, both NULL = 24/7). Cross-midnight is supported: start=1320, end=360 means 22:00–06:00.

No manual reprobe-gone trigger. Fires automatically inside the ingest path on any scan that flips a live service to gone.