Scheduled Scans¶

CloudSlash can scan your infrastructure on a schedule without keeping a process alive and without running a daemon. It registers the job in the operating system's own scheduler:

Every tick is an ordinary cloudslash scan: it inherits your credential chain, saves the graph snapshot, and appends to the same history the rest of the CLI and TUI read.

Hosted workspace schedules¶

You can also schedule scans inside Horizon, without leaving a laptop running. Open Sources → Scheduled scans:

1. Choose a ready connection and one of its source capabilities.
2. Pick an analysis profile (or use the active organization policy).
3. Pick an interval from 15 minutes to 31 days.
4. Choose Create schedule.

Each tick becomes an ordinary hosted scan.analyze job: it uses the same connection preflight, profile pinning, quota, audit trail, and email notifications as a scan you trigger by hand. The first run happens after one interval.

Scheduled ticks count against the workspace scan allowance. If a connection's preflight expires, the tick records connection_unavailable on the schedule until an admin re-verifies the connection. If the account hits its monthly limit, the tick records quota_exceeded and the schedule resumes on the next interval after capacity returns.

Install a schedule¶

cs schedule add --every 15m

That is the whole setup. The first scan runs one interval after install — never at install time — so adding a schedule cannot trigger an unexpected provider call.

Scan flags are passed through after --:

cs schedule add --every 6h -- --region all
cs schedule add --every 1h --name nightly -- --format json

Intervals below one minute are rejected on purpose: provider APIs bill and rate limit per request. For a foreground loop that streams diffs between cycles, use cs watch.

Inspect a schedule¶

cs schedule list

NAME         EVERY      PLATFORM   LOADED   LOG
scan         15m        launchd    yes      /Users/you/.cloudslash/logs/schedule-scan.log

LOADED is the scheduler's own answer, not a CloudSlash guess: launchctl print on macOS, systemctl --user is-active on Linux.

Read the output¶

Each run appends its output to ~/.cloudslash/logs/schedule-<name>.log:

tail -f ~/.cloudslash/logs/schedule-scan.log

A failed run stays a failed run — if credentials expire, the log says so and no snapshot is overwritten. Reauthenticate with your provider's login command (see the plugin README) and the next tick resumes normally.

What a scheduled scan updates¶

This is the same state a manual cs scan writes, so scheduled runs make cs diff and cs trend meaningful without anyone running the CLI.

Remove a schedule¶

cs schedule remove scan

Removal unloads the job and deletes its unit file. Logs are left in place so you keep the audit trail; delete ~/.cloudslash/logs/schedule-*.log yourself if you want them gone.

Security model¶

• The job runs as your user, with your provider credential chain. CloudSlash stores no credentials for scheduled runs; the plugin owns credential discovery.
• Only the scheduler you already use is touched. Jobs are namespaced (dev.cloudslash.scan.*, cloudslash-scan-*, # cloudslash-scan:*) and removal only matches those markers.
• The command is the absolute path to the running binary, so a PATH change cannot hijack a scheduled scan.
• Plugin trust rules are unchanged: unsigned local plugins load with a warning, signed-but-tampered plugins are refused before execution.

Related¶

• CLI reference: schedule
• Continuous watch mode
• Terminal dashboard