Setting Up the Local VM Scanner on Windows

Aikido VM Scanner is a single-package that installs on your system, automatically scanning and identifying dependencies to provide a detailed view into your environment.

Prerequisites

• Minimum system requirements: at least 1GB RAM.
• Preferred system requirements: at least 2GB RAM and 4 CPUs.
• Ensure you have admin privileges on your system
• Make sure to use the appropriate commands for your system or cloud provider
• On Windows, ensure that PowerShell is installed and enabled

Installation and Upgrade

Start PowerShell in admin mode, replace AIKIDO_TOKEN with valid token from Local VM scanning page in Aikido. You can also specify the following optional parameters:

• VM_TYPE as one of: production, staging or development.
• OUTPUT as one of: stdout, stderr or none.
• INITIAL_SCAN as one of: 1 or 0.

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
Invoke-WebRequest -Uri "https://aikido-vm-agent.s3.eu-west-1.amazonaws.com/v1.5.2/AikidoVmScanner.msi" -OutFile "AikidoVmScanner.msi"
msiexec /i AikidoVmScanner.msi /qn /norestart AIKIDO_TOKEN=REPLACE_ME VM_TYPE=production OUTPUT=stdout INITIAL_SCAN=1

If you have an automated process for installation and you always want to be on the latest version, you can use the following link:

• https://aikido-vm-agent.s3.eu-west-1.amazonaws.com/latest/AikidoVmScanner.msi

The VM Scanner Agent runs once a day, at a random time between 4:00 AM - 8:00 AM (machine time).

After install, a first scan will start automatically. If you want to run it on demand, you can manually execute it with the following command in a PowerShell with admin privileges.

& 'C:\Program Files\AikidoVmScanner\AikidoVmScanner.exe'

Connecting through a proxy

If your machine reaches the internet through a corporate proxy, the VM Scanner picks it up from the standard HTTPS_PROXY, HTTP_PROXY, and NO_PROXY environment variables. When none of these are set, it falls back to the Windows system proxy settings, including WinHTTP defaults and PAC scripts. There's no proxy option in config.json and nothing to enable.

The scan itself runs entirely locally. The only outbound traffic is HTTPS (port 443) to bg.aikido.dev, or the regional equivalent such as bg.us.aikido.dev.

Setting the proxy for the daily scan

The daily scan runs as a scheduled task under the SYSTEM account, so the variables have to be set at machine level. Proxy settings configured for your own user account aren't visible to SYSTEM. In an admin PowerShell:

[Environment]::SetEnvironmentVariable("HTTPS_PROXY", "http://proxy.example.com:8080", "Machine")
[Environment]::SetEnvironmentVariable("NO_PROXY", "localhost,127.0.0.1", "Machine")

If your proxy requires authentication, include the credentials in the URL: http://user:password@proxy.example.com:8080.

Instead of environment variables, you can configure the machine-wide WinHTTP proxy, which the scanner also honors:

netsh winhttp set proxy proxy-server="http=proxy.example.com:8080;https=proxy.example.com:8080" bypass-list="localhost;127.0.0.1"

Proxies that perform SSL inspection

When your proxy replaces certificates with ones signed by an internal CA, import that CA into the machine's trusted root store. In an admin PowerShell:

Import-Certificate -FilePath "C:\path\to\corporate-ca.crt" -CertStoreLocation Cert:\LocalMachine\Root

Verifying the proxy is used

Every run records which proxy it detected in the logs at C:\ProgramData\AikidoVmScanner\Logs:

Using proxy http://proxy.example.com:8080 for https://bg.aikido.dev/api/integrations/vm_scan/uploadScanResult

If the proxy isn't picked up, you'll see No proxy detected for ..., connecting directly instead.

Uninstall

Start PowerShell in admin mode and run:

msiexec.exe /x (Get-WmiObject -Class Win32_Product | Where-Object { $_.Name -like "AikidoVmScanner*" }).IdentifyingNumber /qn /norestart

Logs

Logs are available here, along with the last generated SBOM: C:\ProgramData\AikidoVmScanner\Logs