Documentation
Find what you need
Reference docs for every mipo page, generated from the same data that powers the in-app help — plus narrative guides for setup, architecture, security, and compliance.
Start here
Entry points
First Scan
Deploy a scanner and read your first result.
Scanner Install
Run the scanner as a Linux service.
Architecture
How the services and databases fit together.
Security Model
Supply chain, auth, and audit guarantees.
Compliance Evidence
Evidence workflows and their limits.
API Index
Generated index of every documented API call.
Learning paths
Goal-oriented journeys
First Scan
Production Deployment
Scanner Fleet
Audit Evidence
Alerting / Ops
All docs
Browse by section
Overview
Config
Subnets
Subnets define the IPv4/IPv6 network ranges your scanners will probe. Each subnet is specified in CIDR notation and can …
Subnet Groups
Subnet groups organize multiple subnets into named collections for easier scan configuration. Instead of selecting indiv…
FQDNs
FQDN-based scanning allows targeting specific domain names that are resolved to IP addresses at scan time. This feature …
FQDN Groups
FQDN Groups organize collections of FQDNs for use in scan templates, similar to how subnet groups organize subnets. This…
Port Catalog
The port catalog is a reference library of well-known service-to-port mappings (e.g., PostgreSQL = 5432). Use "Add from …
Port Lists
Port lists define named collections of TCP/UDP ports for scanning. Ports can be entered manually or imported from the po…
Port List Groups
Port list groups combine multiple port lists into named collections for comprehensive scan profiles. Instead of selectin…
Scanners
Scanners are stateless Go binaries deployed on customer networks that execute port scans. This page lets you provision n…
Scan Templates
Scan templates combine target subnets (or subnet groups) with port lists (or port list groups) to create reusable scan c…
Scan Template Groups
Scan template groups organize scan templates for scheduling and permissions. A single schedule can reference a group to …
Scanner Groups
Scanner groups organize multiple scanners for multi-vantage-point scanning. When a scan targets a scanner group, separat…
Discovery
Discovery sources let you import IP targets from external systems (cloud providers, firewalls, CMDBs) without storing ex…
Rate Limit Hierarchy
Scan probe rates are governed by a three-level hierarchy: Scanner > Subnet > Port List. The dispatcher computes the effe…
Port Catalog Form
The Port Catalog form creates a new catalog entry or edits an existing one. Catalog entries are the source library that …
Port List Group Form
The Port List Group form creates a new group or edits an existing one. Port list groups bundle multiple port lists into …
Port List Form
The Port List form creates a new port list or edits an existing one. Ports can be entered manually as a comma-separated …
Scan Template Group Form
The Scan Template Group form creates a new group or edits an existing one. Template groups let a single Schedule referen…
Scan Template Form
The Scan Template form creates a new template or edits an existing one. A scan template combines target subnets (or subn…
Scanner Group Form
The Scanner Group form creates a new group or edits an existing one. Scanner groups bundle scanners for multi-vantage-po…
Scanner Form
The Scanner form provisions a new scanner. After submission the page transitions into a guided installation flow with a …
Subnet Group Form
The Subnet Group form creates a new group or edits an existing one. Subnet groups bundle subnets into a single named col…
Subnet Form
The Subnet form creates a new subnet or edits an existing one. A subnet defines an IPv4 or IPv6 network range in CIDR no…
Health > Scanner Protocol
Scanner Job Dispatch
Scanner job dispatch is the pull-based protocol that transfers scan assignments from the dispatcher to each scanner. Sca…
Scanner Heartbeat
The scanner heartbeat protocol maintains liveness and submits system metrics from each scanner to mipo. Scanners send a …
Scanner Binary
The scanner binary download endpoint (GET /scanner/binary/:platform/:arch) intentionally returns 501 Not Implemented. mi…
Ingest Health Check
Each ingest node exposes GET /health which performs a deep three-pool health check across the config, results, and jobs …
Health > Alerting
Alarms
Active and historical system alarms. Alarms are created automatically when built-in rules detect faults (scanner offline…
Events
Read-only log of system events generated by fault detection. Events are emitted by ingest (scanner heartbeat timeouts), …
Notification Log
Read-only log of all notification dispatch attempts. Each row represents one notification sent (or attempted) to a chann…
Health
Job Errors
Structured job-error states from the dispatcher taxonomy. Each row represents a scan job that has been classified by err…
No Scanner
A scan job is assigned to a scanner_id that no longer exists in the scanners table. Most common cause: an operator delet…
Failed Scanner Auth
A scanner exists in the database but has lost its api_key_hash. The scanner cannot authenticate to ingest, so it cannot …
Scanner Disabled
A scanner is administratively disabled but still has outstanding jobs. Disabled scanners do not pick up jobs from ingest…
Scanner IP Changed
A scanner is presenting a different source IP than its bound_ip and has recent failed-auth attempts. Causes: NAT change,…
No Heartbeat
A scanner stopped heartbeating but has assigned or running jobs. The threshold is 2× the offline-after window (4 minutes…
Binary Version Mismatch
A scanner is running a binary version below the platform minimum. Older binaries may be missing protocol features the pl…
Stuck Pending
A scan job has sat in pending status without being claimed for more than 15 minutes. The dispatcher has not handed it to…
Stuck Running
A scanner started a job but never reported completion or further progress. Wall-clock elapsed time exceeds 3× the estima…
Dispatcher Failure
A job was assigned to a scanner but never transitioned to running. The hand-off between dispatcher and scanner did not c…
Expired
A job has been alive longer than the maximum allowed lifetime (24 hours by default) without reaching a terminal state. T…
Result Submit Failed
A scanner has tried 3 or more times in the past hour to POST results for the same job and each attempt has failed. The j…
Scan Deleted
A job belongs to a scan that has been deleted. Without a parent scan to roll up into, the job cannot make meaningful pro…
Target Invalid
A scanner reported the job's targets cannot be parsed. Bad CIDR, malformed port range, or unknown field. Bad targets are…
Rate Limit Exhausted
The slowest-wins rate resolution across the job's scanner, subnet, and port-list levels evaluates to 0 probes/sec. Opera…
Overview
Interactive architecture diagram showing all mipo components and their real-time health status. Each node represents a c…
Health > Services
Manager
Health metrics for the manager service, which handles the user-facing API, GUI, and admin functions on port 3000. Shows …
Ingest
Health and metrics for all ingest nodes. Mipo runs two ingest nodes (ingest-1 and ingest-2) that handle scanner API traf…
Scanners
Monitors the health and connectivity status of all registered scanners. Shows each scanner's current status, version, ne…
Health > Infrastructure
Database Status
Connection pool metrics for the single TimescaleDB cluster that holds the config, results, and jobs schemas. The page ag…
Reverse Proxy Status
Health metrics for the Traefik reverse proxy that terminates TLS and routes all traffic. Scanner API requests (/scanner/…
Backup
Read-only health view of the backup system showing schedule configuration, local storage usage, encryption status, S3 re…
DNS Status
DNS resolution status across four layers: public FQDN resolution via DNS-over-HTTPS, host system resolver configuration,…
HTTPS Status
TLS certificate health, HTTPS connectivity to the public URL, ACME/Let's Encrypt status, and certificate chain validatio…
Scans
Run Scan
Run Scan lets you manually trigger a scan by selecting an eligible scan template. Only templates whose subnets have scan…
Running Scans
Live view of scans currently executing or pending dispatch. Auto-refreshes per your status-refresh-interval preference.
Recent Scans
Quick-triage view of completed and failed scans within your preferred recent window (default 8 hours). Window is configu…
Scan History
Unbounded archive of every completed and failed scan, suitable for audit, period reports, and forensic exploration. Auto…
Schedules
Schedules automate recurring scans on a configurable cadence. Each schedule can run one or more scan templates (or templ…
Results
Displays the detailed findings of a single completed scan, including all discovered hosts, ports, and services. Security…
Execution Proof
Shows the execution-proof receipts for a single scan — one receipt per job (per scanner vantage). Each receipt is durabl…
Job Receipt
The full execution-proof receipt for a single job. It shows the four canonical hashes (target spec, port spec, baseline,…
Schedule Form
The Schedule form creates a new schedule or edits an existing one. A schedule runs one or more scan templates (or templa…
Audit
Changes
The Changes page is the primary compliance audit trail. It logs every create, update, and delete action performed on sys…
Views
The Views page tracks when users access sensitive resources such as scanners, users, roles, and scan results. Unlike Cha…
Auth
The Auth page tracks all authentication attempts including logins, logouts, and failures for both local and OIDC authent…
Port State Changes
The Port State Changes page tracks port state transitions between consecutive scans. The ledger is populated automatical…
Audit Log Integrity
The Audit Log Integrity page lets operators and GRC teams verify that the audit event chain has not been tampered with. …
Admin > Alerting
Alarm Rules
Built-in alarm rules ship pre-configured with mipo and cover scanner health, infrastructure liveness, and core-service a…
Notification Channels
Notification channels define where alarm notifications are delivered. Supported types: webhook (HTTP POST with optional …
Notification Policies
Notification policies define which alarm transitions trigger notifications on which channels. Each policy combines a cha…
Admin > Audit
Admin
Sessions
The Sessions page shows all currently active user sessions and lets administrators terminate individual sessions immedia…
Backups
The Backups page configures automated and on-demand backups of the database cluster. The two toggles, times, and retenti…
Release
A read-only view of this deployment's release posture: app and image version, the schema version of each schema (config/…
Settings
The Settings page configures system-wide parameters including the Public URL (FQDN) which is used to generate scanner pr…
Scanner ACL
The Scanner ACL page exports a merged list of all registered scanner IP addresses, subnets, and ASNs in formats suitable…
Maintenance
The Maintenance page centralizes all container management into a single Admin page. Restart any service, infrastructure …
Resource Limits
mipo enforces hard caps on the number of each resource type that can be created. These limits are defense-in-depth: a co…
Admin > Identity
Users
The Users page manages all user accounts in the system. Users can authenticate via local password, external SSO (OIDC), …
Roles
The Roles page manages permission roles that can be assigned to users. Each role contains a set of scopes following the …
OIDC Configuration
Configure OpenID Connect (OIDC) single sign-on to let users authenticate via your organization's identity provider (Okta…
Admin > SSL
SSL Status
Displays the current TLS configuration for the mipo instance. Shows the active TLS mode (self-signed, custom certificate…
Let's Encrypt
Automatically obtain and renew trusted TLS certificates from Let's Encrypt using the DNS-01 challenge. This method works…
Custom Certificate
Upload your own PEM-encoded TLS certificate and private key to replace the default self-signed certificate. The certific…