Part of epic: nudgebee/nudgebee-enterprise#35404. Can start once P1's credential model settles; final review alongside P6/P7.
What we're writing, in one sentence
The step-by-step guide a customer follows to go from zero to their first populated coverage report — every command included, nothing assumed.
Industry experience (Rapid7 ships a whole helper product because of this) says credential setup is where this model succeeds or fails operationally. This doc is the product surface for that.
Sections to write
1. Create the inventory user on target VMs (they'll push this via their own tooling — Ansible/GPO/cloud-init; we give the commands):
useradd --system --create-home --shell /bin/sh nudgebee-ro
install -d -m 700 -o nudgebee-ro ~nudgebee-ro/.ssh
echo '<public key>' > ~nudgebee-ro/.ssh/authorized_keys
chmod 600 ~nudgebee-ro/.ssh/authorized_keys && chown nudgebee-ro: ~nudgebee-ro/.ssh/authorized_keys
Optional (only if they want SMBIOS UUID with root confidence — everything else needs no privilege):
# /etc/sudoers.d/nudgebee-ro
nudgebee-ro ALL=(root) NOPASSWD: /usr/sbin/dmidecode -s system-uuid
State plainly what the user can and cannot do: read-only commands, no shell profile tricks, no write access anywhere.
2. Register the SSH credential with the forager — via existing secrets flow (local file or cloud-push); include the exact config snippet.
3. Hypervisor read-only account — per whichever connector P4 built: vCenter (create user, assign built-in Read-Only role at the datacenter level), or Proxmox (API token with PVEAuditor), or libvirt (SSH account on the KVM host). Screenshots or exact CLI.
4. AD bind account — unprivileged domain account, no group memberships; the DN + base-DN values to put in the forager config.
5. Firewall & IDS — the checklist that prevents the "your monitoring tool attacked us" ticket:
- Allow forager → targets on TCP 22 within scanned CIDRs.
- Whitelist the forager IP in Darktrace/Suricata/whatever IDS they run — an unannounced sweep looks exactly like an attacker.
- Forager needs only outbound 443 to the relay; no inbound ports.
6. Choosing scan scope — which CIDRs to opt in, exclusion lists (printers, OT gear, appliances), scan windows.
7. Verify — "within X minutes you should see hosts appear; here's what each gap reason means and the fix" (maps 1:1 to the P7 gap table).
Acceptance criteria
Part of epic: nudgebee/nudgebee-enterprise#35404. Can start once P1's credential model settles; final review alongside P6/P7.
What we're writing, in one sentence
The step-by-step guide a customer follows to go from zero to their first populated coverage report — every command included, nothing assumed.
Industry experience (Rapid7 ships a whole helper product because of this) says credential setup is where this model succeeds or fails operationally. This doc is the product surface for that.
Sections to write
1. Create the inventory user on target VMs (they'll push this via their own tooling — Ansible/GPO/cloud-init; we give the commands):
Optional (only if they want SMBIOS UUID with root confidence — everything else needs no privilege):
State plainly what the user can and cannot do: read-only commands, no shell profile tricks, no write access anywhere.
2. Register the SSH credential with the forager — via existing secrets flow (local file or cloud-push); include the exact config snippet.
3. Hypervisor read-only account — per whichever connector P4 built: vCenter (create user, assign built-in Read-Only role at the datacenter level), or Proxmox (API token with PVEAuditor), or libvirt (SSH account on the KVM host). Screenshots or exact CLI.
4. AD bind account — unprivileged domain account, no group memberships; the DN + base-DN values to put in the forager config.
5. Firewall & IDS — the checklist that prevents the "your monitoring tool attacked us" ticket:
6. Choosing scan scope — which CIDRs to opt in, exclusion lists (printers, OT gear, appliances), scan windows.
7. Verify — "within X minutes you should see hosts appear; here's what each gap reason means and the fix" (maps 1:1 to the P7 gap table).
Acceptance criteria