FAQs
Q: The scan reports that credentialed checks were not performed. How do I troubleshoot?
Check the Arcon debug log attachment for the credential plugin. Look for login failures, API error messages, or missing password/username values in the response.
Q: When should I use the PAM Platform field?
Leave this field blank in most cases — the integration uses a default type string based on the credential type (Linux for SSH, Windows for Windows, and the database name for Database). Only set this field if your ARCON environment uses a custom or non-standard platform type string for the target systems, as advised by your ARCON administrator.
Q: Why does ARCON make more API calls than other PAM integrations?
The ARCON API requires the target IP address to look up a credential, so the integration must make a separate request for each scan target. Other integrations that use a fixed secret identifier can reuse the same cached credential for all targets.
Q: What is the Checkout Duration?
The Checkout Duration (OpenForHours) is the number of hours for which ARCON holds the credential checkout open. It must be a positive integer — a value of 0 is not valid. Set this to a value that exceeds the total expected scan duration. The maximum accepted value varies by ARCON deployment; consult your ARCON administrator for guidance.