scan_target
Run a read-only compliance scan on a vCenter target against a baseline, persist snapshot and violation data locally, and enable drift detection for audit.
Instructions
[READ] Run a compliance scan of a vCenter target against a baseline and
persist results locally. target (required string): a vCenter target name
as configured in vmware-aiops. baseline (optional string, default
'cis-vmware-esxi-8.0-subset'): a baseline id from list_baselines. Makes
read-only vCenter API calls (inventory collection only — never modifies
VMware infrastructure) and writes a new snapshot, violations, and drift
events (vs the prior scan of the same target) to the local twin DB
(~/.vmware-harden/twin.duckdb). Returns summary counts {snapshot_id,
target, baseline, hosts, violations, coverage, note}; inspect details via
list_violations and list_drift_events. violations is meaningful only
together with coverage: rules whose data no collector gathers are not
executed and count as undetermined, never as passing, so violations=0 is
not by itself evidence of compliance. When coverage.complete is false,
report how many rules were evaluated out of how many instead of calling
the estate compliant. May take minutes on large inventories.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| target | Yes | ||
| baseline | No | cis-vmware-esxi-8.0-subset |