Keep your server names inside the company

“From the first server to the report”, episode 1 of 9

Picture the first scan you are about to run. You have chosen a server, but its hostname includes a customer, a location and an application role. That naming convention is useful to your operations team. You may have no reason to repeat it in an external dashboard. Before running anything, someone asks a sensible question: what information will leave the machine?

“Just the scan results” is not a useful answer. Results describe the operating system and its software, and names can appear in more than one place. This series starts with that data boundary. Installation comes after you understand what you intend to share and who in your organisation can approve it.

Here I cover a custom label, a local trial without uploading results, and the limits of both. The instructions are for Linux administrators. They also give the person reviewing confidentiality something more useful than a list of command line switches.

What the agent sends

Secvalis scans Linux hosts and images of running containers. That includes system packages and language packages recognised by the scanner. System containers have an additional scan path that deserves separate consideration. This does not mean every device on the network is scanned.

The table describes the data the current script builds for a normal upload. Some values can be empty when the source does not provide them. An empty field in one test does not prove that the entire category will always be absent.

Group	Information sent	What to review
Machine identity	machine_label, hostname	Whether the label itself reveals a customer or server role
Operating system	distro, distro_version	Whether the distribution and version may be shared
Scan	agent_version, scan_timezone, scan_status	Agent version, time zone, complete, partial or failed result
Host state	system_state.running_kernel, reboot_required	Running kernel and reboot indication where available
Result provenance	Trivy database update time where available; Target, Class, Type	Confidential names in scan targets or paths
Container images	_sourceImage, _sourceImageId where present	Repository names, tags and image identifiers
Vulnerabilities	Identifier, package, installed and fixed versions, severity, status, title, description limited to 300 characters, reference	What the findings reveal about installed software

The API key authenticates the upload through a request header. It is not a finding in this table, but it still needs protection. Keep it out of command screenshots and support messages. The local JSON preview does not include the key. That is a statement about the preview, not a promise that the whole terminal is safe to share.

A label instead of the hostname

--label=server-01 sets a custom label. Setting a label alone does not suppress the hostname field. That requires --no-hostname, which in turn requires an explicit --label. Without that requirement, the script could use the short hostname as its label and disclose the very name you wanted to keep internal.

Choose a label your team can resolve through an internal inventory without including the customer, site or application name. Keep that mapping in your own documentation. A neutral identifier only helps operations if someone can reliably connect it to the right host. Decide who updates the mapping when the server is replaced.

Avoid changing labels casually between runs. Record the chosen value in the launch configuration and check it again when adding a schedule. A switch typed for an interactive test is easy to omit from the later timer. Naming is a small deployment decision, but it needs to survive that transition.

A local trial

Assume you have already obtained and reviewed the script and saved it as /opt/secvalis.sh. On your chosen Linux server, use a session with permissions suitable for reading the system being scanned:

bash /opt/secvalis.sh --dry-run --label=server-01 --no-hostname

This mode does not require an API key. It performs a scan without uploading its results to Secvalis. It can still download Trivy and its vulnerability database. This is not an offline mode or a promise of no network traffic. On a host with restricted outbound access, arrange the trial under that host's normal access rules.

Stop sharing your screen before running it. The local terminal output includes the real hostname even with --no-hostname. The JSON preview, separately, shows hostname: null. Checking only the JSON misses the identifying line printed above it.

This is an illustration of a manually redacted terminal excerpt, not a captured test result:

Machine label: server-01
Hostname: [entire line manually redacted before sharing]

The dry run preview contains selected fields and a finding count. It is not a full dump of the normal upload. Do not use the absence of image names or kernel details in that preview as evidence that the upload excludes them. Review the data categories above against the actual environment. A local trial helps establish how the scan starts and which label it uses; it cannot settle every data handling question.

What still identifies the environment

A custom label does not remove the distribution, package versions or vulnerability details. A container image name can include the company or service name. A scan target may disclose a path. Even a set of packages can be characteristic of a particular application when the host names are neutral.

--no-hostname is not anonymisation. It limits one field. If your organisation needs a wider restriction, establish which data is acceptable before expanding the deployment. Do not turn the existence of a switch into a promise it cannot fulfil. Refusing to share a category of data is a scope decision, not a failure by the person reviewing confidentiality.

LXC needs a separate check. On a recognised Proxmox host, the script can enter that path automatically and uses container names as labels for container results. A neutral host label does not replace those container names. The local trial above exits before the later LXC upload path, so it does not validate that path's scope. A regular Linux host with known contents is a more controlled starting point.

I would write a short trial note with the chosen machine, label, scan scope, recipient and approved data categories. Include who approved the trial. This is enough to recover the original decision when moving from one host to several. It avoids assuming that approval for a small experiment covered the entire estate.

Showing results safely

The public demo uses a fictitious company. It is suitable for discussing the interface before deciding to share production data. Label a screenshot “demonstration data”. Do not present it as a scan of your own infrastructure or imply that its figures describe your results.

If a real result is needed, prepare a separate image for sharing. Check the terminal, browser tab, address bar, image names and visible account details. Redact the exported image and reopen it before sending it. A custom label in the scan command does not perform that review for you.

Separate an interface demonstration from a technical assessment. A meeting can use the demo. The administrator assessing deployment needs the field list and the script. The person deciding on confidentiality needs to understand what stays inside the organisation and what is sent. A single screenshot will not answer all three needs well.

Keep the original result in the appropriate internal location and make the shared copy deliberately. This also makes later discussion easier: everyone knows whether they are looking at demonstration data, a redacted example or the actual operational record. The distinction is useful even when there is nothing confidential in the particular view you chose.

What this does not cover

Secvalis covers vulnerabilities on Linux servers, their packages and supported containers. It does not scan Windows, OT, PLCs or SCADA. It does not discover unreported devices. The machines visible in the dashboard therefore do not replace an infrastructure inventory.

Choosing a label also does not settle confidentiality arrangements or access policy. Secvalis can support vulnerability management and evidence preparation; installation alone does not establish NIS2 compliance or ISO 27001 certification. For this first trial, keep the goal concrete: an understood data scope, an explicit sharing decision and a verified local result.

Need help with deployment? Write to me: https://sysdevops.eu/kontakt. We will agree the scope, confidentiality and formalities individually.