Run your first scan
This page picks up where Create your workspace left off. The Onboarding Checklist is pinned to your Command Center showing the next steps for the goals you picked in the Goal Selector. You pick one to start with, connect credentials, and wait for the first scan to land.
You don't have to connect everything at once. One source is enough to make the rest of Retrievy come alive.
This is an onboarding navigation page. Each linked guide carries its own screenshots for the credential-creation and wizard flows.
Before you start
- A workspace with an active plan (see Create your workspace).
- The Create, edit, and delete cloud accounts permission (under Settings: Cloud Accounts in Settings → Roles & Permissions) for cloud connections, or Create, rotate, and revoke agent tokens (under Settings: Agent Tokens) for installing an agent. The workspace founder has both.
- At least one data-source slot free on your plan (Essentials starts with 2, Advanced with 4).
Pick your first data source
The fastest first scan depends on what you have:
| If you have... | Start with | Approx. time to first scan |
|---|---|---|
| An AWS account you can create an IAM user in | Connect an AWS account | About 15 minutes total: 5 min to create the IAM user and access keys on AWS, 1 min for the Retrievy wizard, then 5 to 10 min for Retrievy's CSPM scanner to complete the first run. |
| A Windows server you can install an MSI on | Install the agent on Windows | About 10 minutes total: 5 min to install the MSI, then 1 to 5 min for the first AD + GPO scan. |
| A Linux host with Docker and a FortiGate firewall to scan | Install the agent with Docker | About 10 minutes total: container starts in seconds, then 1 to 5 min for the first FortiGate scan. |
Each setup guide is self-contained. Click through, do the steps, and come back here when the first scan is in.
Watch the first scan land
You can watch the scan from two places:
- The data-source page (Settings → Cloud Integrations for cloud, or Fleet → Agents for an agent). The new row shows a Scanning... state then flips to Scan Success or Scan Failed when it's done.
- The Command Center, where the Recent Scans list at the bottom of the page picks up the run as it starts and updates live.
A first scan typically takes a few minutes for a small environment and longer for a large one. The Command Center updates live; you don't need to refresh.
What happens when the scan completes
The moment the first scan ingests:
- Your Retrievy Index populates with a real number. Until then, the Command Center showed the Waiting for your first audit state in the centre of the page.
- Findings appear in the Hardening Kanban Triage Required column.
- The module slate for whichever module you connected (Post-Scan CSPM, Post-Scan ISPM, Post-Scan SCM) lights up with a finding count.
- The Compliance Hub starts showing your findings mapped across the family of frameworks Retrievy supports (CIS, NIST CSF, NIST 800-53, ISO 27001, SOC 2, PCI DSS 4.0, HIPAA, MITRE ATT&CK, and more).
- The Onboarding Checklist marks the corresponding step as done.
If every connected scan completes with zero findings, you see Elite Security Posture instead of a populated Retrievy Index. That's rare on a real environment; double-check that the scan actually completed (not silently failed) before celebrating.
First triage
Once you have findings, head to the Hardening Kanban. Three things to try on day one:
- Filter to the things that matter most. Click the On Fire quick-preset chip in the toolbar to see Critical findings with breached SLAs. If the list is empty, try Unassigned Critical instead.
- Open a finding. Click any card. The drawer has tabs for Overview, Remediation (with copy-paste fixes), Evidence (raw scanner output), and Assignment.
- Move a finding through the workflow. Pick something easy. Click Resolve Finding (it requires a confirm click). The card moves to Verifying Remediation with the Pending Verification badge. Wait for the next scan to confirm and it'll auto-flip to Hardened / Resolved.
This is the loop you'll repeat going forward. Connect, scan, triage, resolve.
Set up additional data sources
After the first source works end-to-end, add the others. Each one runs the same loop: configure credentials, watch the first scan complete, see findings flow into the Kanban and Command Center.
Common day-two and day-three additions:
- A second cloud account from a different provider (Azure, GCP, OCI, Cloudflare).
- A Windows Agent if your first source was cloud (and you have on-prem AD).
- A Docker Agent if you also have FortiGate firewalls to audit.
- The Compliance Hub to start eyeballing CIS, NIST, ISO, SOC 2, or PCI coverage.
Watch your Slot Limit Reached ceiling on the data-source count. Essentials gives you 2 slots, Advanced gives you 4. See the Plan feature matrix to size up.
Troubleshooting
Symptom: First scan finished but the Command Center still shows Waiting for your first audit. → Fix: Reload the page. The live connection sometimes lags on first sign-in. If the message persists after a reload, check the Recent Scans list at the bottom of the Command Center; if the scan shows as failed, follow the troubleshooting steps in the specific data-source guide.
Symptom: Scan succeeded but only a handful of findings appear. I expected more. → Fix: Your IAM user (cloud) or agent service account (on-prem) probably has limited permissions. Re-check the permission set in the relevant setup guide. For AWS specifically, the recommended set is SecurityAudit + ViewOnlyAccess; anything narrower can silently skip whole categories of checks.
Symptom: Onboarding Checklist still shows the connection step as undone after the first scan landed. → Fix: The checklist refreshes on scan-complete events. Hard-refresh once. If it still shows undone, it's a cache miss; the next scan event will update it.
Symptom: I want to skip the first source and just play with the UI. → Fix: The UI is fully browsable without data; pages show empty states like Zero Data / Synchronized until something lands. There's no demo-data toggle today, so to see real-looking screens you do need to connect at least one source.