Overview
SPOG.AI integrates with Windows Servers and Windows 10/11 endpoints to provide exhaustive discovery of hardware, software, network, security, and performance data. The SPOG.AI Discovery Appliance connects over WinRM using authorized credentials, and all collected data is securely transmitted to the SPOG.AI CMDB for analytics, compliance monitoring, and incident management. Administrator accounts can connect directly with no extra configuration, while standard domain users must be granted rights to run WinRM queries. A dedicated domain service account with limited privileges and a non-expiring password is recommended.
Key Features
| Capability | Description |
| Hardware & System Inventory | Discovers OS version, hardware details, BIOS, CPU, memory, and storage. |
| Network Configuration | Collects IP addresses, MAC addresses, routes, and interfaces. |
| Software & Service Discovery | Identifies installed applications, running services, and scheduled tasks. |
| Security & Access Visibility | Captures local users, domain groups, active sessions, event logs, audit events, and security alerts. |
| Patch & Update Tracking | Reports installed updates and missing patches. |
| Performance Metrics | Collects CPU load, memory usage, and disk I/O statistics. |
| Flexible Authentication | Supports Kerberos, NTLM, or Basic (over HTTPS), with password or vault-based credentials. |
| Scheduled Discovery & CMDB Enrichment | Runs discovery on a configured schedule and populates the CMDB with asset metadata. |
How the Integration Works
Once configured, the SPOG.AI Discovery Appliance connects to Windows hosts over WinRM (HTTP on port 5985 or HTTPS on port 5986) using authorized credentials, entered directly or retrieved from an integrated credential vault. It collects hardware, software, and network configuration details, installed applications and running services, security configurations and patch information, and performance and event log data. Discovery cycles run on a configured schedule, with a default of every 24 hours. All collected data is securely transmitted to the Configuration Management Database (CMDB) within SPOG.AI for analytics, compliance monitoring, and incident management.
Data Collected
| Category | Data Collected | Description |
| System Inventory | OS version, hardware details, BIOS, CPU, memory, storage | Hardware and operating system profile of the host. |
| Network Configuration | IPs, MACs, routes, interfaces | Network identity and connectivity of the host. |
| User & Access Control | Local users, domain groups, active sessions | Accounts and access present on the host. |
| Security Logs | Event logs, audit events, security alerts | Security and audit activity on the host. |
| Service & Process Info | Installed applications, running services, scheduled tasks | Software and services running on the host. |
| Patch & Update Info | Installed updates, missing patches | Patch posture of the host. |
| Registry & Configuration | System configurations, policy compliance | Configuration and compliance state. |
| Performance Metrics | CPU load, memory usage, disk I/O statistics | Resource utilization of the host. |
Prerequisites
Before configuring the integration, ensure the following prerequisites are met:
- Supported OS: Windows Server 2016 / 2019 / 2022, or Windows 10/11 (Enterprise/Pro).
- WinRM (Windows Remote Management) enabled and configured on the target host.
- An Administrator account, or a delegated domain account with WinRM access rights. The password should be set to never expire.
- A SPOG.AI Discovery Appliance that can reach the target hosts on the required ports.
- Access to the SPOG.AI Dashboard to add the integration under a specific tenant.
Configuration
1. Choose the Discovery Account
The account used by SPOG.AI determines how much WinRM setup is needed. Choose one of the following:
| Account Type | Access | Configuration Required |
| Administrator | Full access via WinRM. | No additional configuration required. |
| Domain User | WinRM execution rights and PowerShell remote access. | Add manually via Set-PSSessionConfiguration. |
| Local User | Local WinRM access only. | Configure WinRM authentication manually. |
Recommendation: Use a dedicated domain service account for SPOG.AI discovery with a non-expiring password and limited privileges for security compliance.
2. Enable the WinRM Service
- Log in to the Windows Server as an Administrator.
- Open PowerShell and run:
winrm quickconfigThis command:
- Starts the WinRM service and sets it to auto-start.
- Creates a default listener on port 5985 (HTTP).
- Configures the WinRM firewall exceptions.
3. Allow a Domain User to Access WinRM
Complete this step only if you are using a non-administrator domain account.
- Run the following command in PowerShell:
Set-PSSessionConfiguration -Name Microsoft.PowerShell -ShowSecurityDescriptorUI
- In the Security Descriptor UI, click Add, enter the domain username, and select Check Names.
- Assign Allow permissions for Full Control, Read, and Execute.
- Click OK to apply.
4. Configure Firewall Rules
Enable inbound WinRM traffic by running the following commands in PowerShell:
netsh advfirewall firewall add rule name=”WinRM HTTP” dir=in action=allow protocol=TCP localport=5985
netsh advfirewall firewall add rule name=”WinRM HTTPS” dir=in action=allow protocol=TCP localport=5986
Ensure the following ports are reachable for each authentication method:
| Authentication Method | Required Ports |
| Domain User | ICMP Ping, TCP/135, 80, 443, 139, DCOM, WinRM (5985/5986) |
| Local User | WinRM (configured separately) |
Also allow the following traffic between the SPOG.AI Discovery Appliance and the Windows Server:
| Component | Port | Protocol | Direction | Purpose |
| SPOG.AI Appliance → Windows Server | 5985 / 5986 | HTTP / HTTPS (WinRM) | Outbound | Remote management |
| SPOG.AI Appliance → Windows Server | 135, 139, 445 | TCP | Outbound | DCOM, SMB communication |
| Windows Server → SPOG.AI | 443 | HTTPS | Outbound | API data exchange (optional) |
Tip: For encrypted communication, enable the HTTPS listener using a valid SSL certificate.
5. Configure Windows for Remote Connections
Run the following commands in PowerShell:
Set-Item WSMan:\localhost\Service\AllowUnencrypted -Value $true
Set-Item WSMan:\localhost\Client\TrustedHosts -Value "<Appliance-IP>"
winrm set winrm/config/client/auth '@{Basic="true"}'
winrm set winrm/config/service/auth '@{Basic="true"}'Then add the domain user to the trusted hosts:
winrm set winrm/config/client '@{TrustedHosts="domainuser"}'Note: These settings enable Basic authentication and unencrypted traffic. To protect credentials and data, use the HTTPS listener with a valid SSL certificate and prefer domain credentials with Kerberos or NTLM wherever possible.
6. Verify WinRM and Test Connectivity
Check that WinRM is active:
winrm enumerate winrm/config/listener
From the SPOG.AI Discovery Appliance or another host, test connectivity to the target:
Test-WSMan <Target-ComputerName>
If the test is successful, proceed to the SPOG.AI configuration.
7. Configure Windows in SPOG.AI
- Log in to the SPOG.AI Dashboard.
- Navigate to Administration → Connected Hub → Add → Search Windows Discovery.
- Go to Configuration and provide the following details:
| Field | Description |
| Integration Name | Enter a name, for example Windows Discovery. |
| CIDR/Subnet | Define the target network range for discovery. |
| Authentication Type | Select Password or Vault-based authentication. |
| Username | Enter the domain or local Windows account. |
| Password | Provide the account credentials (set the password to never expire). |
| Exclude Service Type (Optional) | Specify services to exclude from scanning. |
Click Save to complete the configuration.
8. Validate the Integration
- Execute a discovery cycle and confirm that the Windows host is discovered.
- Verify that Windows server details (OS, CPU, RAM, IP, and so on) appear accurately.
- Run a Test Connection from SPOG.AI to confirm WinRM communication.
- Review the Discovery Appliance logs for any access or permission errors.
- Verify that asset metadata populates in the CMDB.