Skip to main content
Sherlock Suite

Product documentation

Which product are you working with?

Choose a product to see its guides and setup instructions.

All documentation

Monitoring, alerts and reports

Track discovery health, review network changes, and share useful inventory reports.

Scanner connectivity

Scanners send periodic heartbeats, including during scans. The connection display uses recent contact within two minutes. Connected does not mean discovery is enabled or that every discovered device is currently online.

Inspect Scanners and Scan history for version, schedule, recent contact, run status, checked addresses, device counts, and errors.

In-app alerts

  • Newly discovered devices and confirmed IP changes.
  • Missing devices after repeated successful full scans.
  • Offline scanners and repeated scan failures.

By default, missing-device alerts require 24 hours and three successful full scans. Failed or partial scans do not count. Scanner-offline checks use a five-minute threshold, and repeated-failure alerts follow three terminal failures. Administrators can manage supported alert preferences under Settings.

Alerts are evaluated periodically, so they may not appear immediately. Returning devices or scanners resolve their health conditions. Acknowledging an alert records your review; it does not repair the underlying issue. Notifications are in-app; email, SMS, and webhook delivery are not included.

Optional SNMPv3 monitoring

  1. Configure a read-only SNMPv3 account on the network equipment first.
  2. As a Network administrator, open Settings and assign a monitoring profile to the relevant scanner.
  3. Enter the user and supported authentication/privacy settings. SHA-256 is preferred; SHA-1 is available for compatibility, with AES-128 privacy.
  4. Save the profile and run discovery against the explicitly configured ranges.

Monitoring is optional and does not start before a profile is saved. The scanner sends read-only GET and GETBULK requests and does not follow neighbors outside its configured scope.

Available snapshots include system identity and uptime, up to 16 interface states, and bounded topology observations. Results may be partial or stale when a later request fails. Credentials are encrypted in the service and delivered only to the assigned scanner over HTTPS for the scan; the scanner does not persist them in its configuration or outbox.

Reports and exports

Open Reports for a live summary, printable view, and CSV inventory, unmanaged-device, alert, or IP-change exports. Choose supported date ranges before exporting. Access remains scoped to your organization and product role.

Exports are bounded to 100,000 records per requested range. For larger histories, choose smaller ranges. Print uses your browser's print dialog.

For collection problems, see troubleshooting.