Host OS inference

What it is

A per-host OS field that’s the most-common non-null OS attribution across all of that host’s fingerprinted services. Materialised at write time so the Hosts page reads hosts.os directly (no per-row vote at query time).

What it produces

hosts.os field with a normalised string: Ubuntu, Embedded Linux, Windows Server 2019, FreeBSD, etc. NULL when no service on the host volunteered an OS hint.

What to use it for

• Inventory roll-ups: “how many Windows boxes do we still have on the perimeter?”
• Patch-cycle planning: filter hosts by OS, see what versions are exposed
• Targeting the right RustScan flag set: some Windows hosts get RST instead of timeout, the worker uses the OS to tune retries

Why it matters

Service-level OS hints (e.g. Server: Apache/2.4 (Ubuntu)) are unreliable in isolation. Different services on the same host can report different things, and one may be a misconfigured proxy. A host-level vote across N services collapses noise.

Why it’s valuable

• No banner-spoof fragility. A single tampered banner can’t flip the host’s OS attribution; the majority wins.
• No second probe. Computed from existing fingerprint evidence, no extra scan traffic to the customer’s network.
• Filterable. os:windows, os:"Embedded Linux", etc. work in the hosts grammar.

How to use it

Filter inventory via SmartSearch:

os:windows                          # all Windows hosts
os:"Embedded Linux" hosting:false   # non-cloud embedded devices
os:ubuntu has_cve:true              # Ubuntu hosts with CVEs

Or click the OS chip on any host detail page to see every other host running the same OS.