Supported Scan Targets
A list of technologies that cnspec can scan
cnspec can make assertions against and scan a wide range of platforms, from cloud accounts and Kubernetes clusters to network devices, SaaS providers, and individual hosts. The table below lists every supported scan target with an example command. Each linked target name opens a guide with prerequisites, authentication details, and more examples.
New to cnspec? Start with the Quickstart to install cnspec and run your first scan. For a full breakdown of the cnspec scan command and its flags, read the cnspec scan CLI reference.
cnspec can make assertions against and scan the following targets:
| Target | Example |
|---|---|
| Active Directory domains | cnspec scan activedirectory --dc DC_HOST --user USER --password PASSWORD |
| AIX hosts | cnspec scan ssh user@HOST |
| Ansible playbooks | cnspec scan ansible YOUR_PLAYBOOK.yml |
| Arista EOS network devices | cnspec scan arista USER@DEVICE_PUBLIC_IP --ask-pass |
| Atlassian organizations | cnspec scan atlassian --host YOUR_HOST_URL --admin-token YOUR_TOKEN |
| AWS accounts | cnspec scan aws |
| AWS CloudFormation templates | cnspec scan cloudformation cloudformation_file.json |
| AWS EC2 EBS snapshot | cnspec scan aws ec2 ebs snapshot SNAPSHOTID |
| AWS EC2 EBS volume | cnspec scan aws ec2 ebs volume VOLUMEID |
| AWS EC2 Instance Connect | cnspec scan aws ec2 instance-connect ec2-user@INSTANCEID |
| AWS EC2 instances via SSM | cnspec scan aws ec2 ssm INSTANCEID |
| Azure Bicep templates | cnspec scan bicep main.bicep |
| Cisco Catalyst Center | cnspec scan ciscocatalyst HOST --user ADMIN --ask-pass |
| Cisco IOS / NX-OS devices | cnspec scan nd-ssh USER_NAME@DEVICE_IP --ask-pass |
| Cloudflare | cnspec scan cloudflare --token TOKEN |
| Confluence users | cnspec scan atlassian --host YOUR_HOST_URL --admin-token YOUR_TOKEN |
| Container images | cnspec scan container ubuntu:latest |
| Container registries | cnspec scan container registry index.docker.io/library/rockylinux:8 |
| Datadog accounts | cnspec scan datadog --api-key API_KEY --app-key APP_KEY |
| deps.dev Go module dependencies | cnspec scan depsdev --path PATH/TO/go.mod |
| DigitalOcean accounts | cnspec scan digitalocean --token YOUR_API_TOKEN |
| DNS records | cnspec scan host mondoo.com |
| Dockerfiles | cnspec scan docker file FILENAME |
| Equinix Metal organizations | cnspec scan equinix org ORG_ID --token YOUR_API_TOKEN |
| F5 BIG-IP devices | cnspec scan bigip --hostname DEVICE_IP --username admin --ask-pass |
| Fortinet FortiOS devices | cnspec scan fortios --hostname DEVICE_IP --token API_TOKEN |
| FreeBSD hosts | cnspec scan ssh user@HOST |
| GitHub organizations | cnspec scan github org mondoohq |
| GitHub repositories | cnspec scan github repo mondoohq/cnspec |
| GitLab groups | cnspec scan gitlab --group mondoohq |
| Google Cloud projects | cnspec scan gcp |
| Google Workspace | cnspec scan google-workspace --customer-id CUSTOMER_ID --impersonated-user-email EMAIL --credentials-path JSON_FILE |
| Grafana organizations | cnspec scan grafana --token TOKEN --url https://myorg.grafana.net |
| Helm charts | cnspec scan helm ./my-chart |
| Hetzner Cloud projects | cnspec scan hetzner --token YOUR_API_TOKEN |
| IPMI | cnspec scan ipmi USER@HOST --ask-pass |
| Jamf Pro | cnspec scan jamf --client-id CLIENT_ID --client-secret CLIENT_SECRET --instance-domain https://yourdomain.jamfcloud.com |
| Jira projects | cnspec scan atlassian --host YOUR_HOST_URL --admin-token YOUR_TOKEN |
| Juniper Junos OS devices | cnspec scan junos --hostname DEVICE_IP --username admin --ask-pass |
| Kubernetes cluster nodes | cnspec scan ssh user@host |
| Kubernetes clusters | cnspec scan k8s |
| Kubernetes manifests | cnspec scan k8s manifest.yaml |
| Kubernetes workloads | cnspec scan k8s --discover pods,deployments |
| Kustomize overlays | cnspec scan kustomize ./overlays/production |
| Linux hosts | cnspec scan local orcnspec scan ssh user@host |
| macOS hosts | cnspec scan local orcnspec scan ssh user@IP_ADDRESS |
| MCP servers | cnspec scan mcp http https://mcp.example.com/mcp |
| Microsoft 365 tenants | cnspec scan ms365 --tenant-id TENANT_ID --client-id CLIENT_ID --certificate-path PFX_FILE |
| Microsoft Azure subscriptions | cnspec scan azure --subscription SUBSCRIPTION_ID |
| Nutanix Prism Central | cnspec scan nutanix --endpoint pc.example.com --api-key API_KEY |
| Okta org | cnspec scan okta --token TOKEN --organization ORGANIZATION |
| OPC UA IoT devices | cnspec scan opcua |
| OpenStack projects | cnspec scan openstack --cloud my-cloud |
| Oracle Cloud Infrastructure (OCI) | cnspec scan oci |
| Palo Alto Networks PAN-OS devices | cnspec scan panos --hostname DEVICE_IP --username USERNAME --ask-pass |
| Proxmox VE clusters | cnspec scan proxmox --host https://HOST:8006 --token 'PVEAPIToken=user@realm!tokenid=secret' |
| Running containers | cnspec scan docker CONTAINER_ID |
| Shodan search engine | cnspec scan shodan --token TOKEN |
| Slack team | cnspec scan slack --token TOKEN |
| Snowflake | cnspec scan snowflake --account ACCOUNT-ID --region REGION --user YOUR-USER-ID --role YOUR-ROLE --ask-pass |
| SSL certificates on websites | cnspec scan host mondoo.com |
| STACKIT projects | cnspec scan stackit --project-id PROJECT_ID --service-account-key-path SA_KEY_FILE |
| Tailscale | cnspec scan tailscale --token TOKEN |
| Terraform HCL | cnspec scan terraform HCL_FILE_OR_PATH |
| Terraform plan | cnspec scan terraform plan plan.json |
| Terraform state | cnspec scan terraform state state.json |
| Ubiquiti UniFi controllers | cnspec scan unifi --hostname CONTROLLER_IP --username admin --ask-pass |
| Vagrant virtual machines | cnspec scan vagrant HOST |
| vLLM servers | cnspec scan vllm https://vllm.example.com --api-key API_KEY |
| VMware Cloud Director | cnspec scan vcd user@domain@host --ask-pass |
| VMware vSphere | cnspec scan vsphere user@domain@host --ask-pass |
| Windows hosts | cnspec scan local,cnspec scan ssh Administrator@IP_ADDRESS --ask-pass orcnspec scan winrm Administrator@IP_ADDRESS --ask-pass |
| YARA file scanning | cnspec shell then use yara.scan(path: "/path/to/file") |