For AI agents: the complete documentation index is available at https://www.jumpserver.com/docs/llms.txt, the full documentation bundle is available at https://www.jumpserver.com/docs/llms-full.txt, and this page is available as Markdown at https://www.jumpserver.com/docs/features/pam/security/risk-detection.md.
🎉 JumpServer v5.1.1 is available. See what's new →
  • v5

    • Risk Detection

    Enterprise Edition

    Risk Detection requires JumpServer Enterprise Edition. Without a license, the Security > Risk Detection tabs are disabled.

    Request 14-day free trial

    Risk Detection checks the credentials of accounts already managed by JumpServer for weaknesses such as short or simple passwords, passwords reused across accounts, and passwords that appear in common leak lists. It does not connect to assets to discover accounts; the accounts must already be inventoried and have credentials configured.

    Use it together with Discover Accounts when you need to compare managed accounts against what actually exists on the servers.

    Prerequisites

    • Access to PAM > Security > Risk Detection with permission to view detection results and tasks.
    • Target assets or nodes exist and their accounts are managed with credentials. See Accounts.
    • At least one detection engine is enabled.

    Overview

    The page contains four tabs:

    • Detection results – risks found by executed detection tasks.
    • Detection tasks – task definitions and their schedule.
    • Execution history – per-run status, duration, and log.
    • Detection engines – the checks available in this environment.

    Figure 1: Detection results grouped by asset with risk and status columns

    Create a detection task

    1

    At the top-left of the page, select , then click PAM.

    image
    2

    Open Security > Risk Detection and select Detection tasks.

    3
    Click Create.
    4
    In the Name field, type the task name.
    5

    In the Assets and Nodes fields, select the scope to check. The two fields can be combined.

    6

    In the Engines field, select one or more detection engines. This field is required.

    7

    Optionally select Recipients to receive the result by email. Only email delivery is supported.

    8

    Optionally enable Periodic and set Interval or Crontab. Keep Active selected and click Submit.

    Field reference

    FieldDescription
    NameRequired. Task name.
    Assets / NodesAssets and nodes whose accounts are checked; both can be selected.
    EnginesRequired. One or more detection engines.
    RecipientsUsers notified by email after execution.
    PeriodicRepeats the task on a schedule; crontab takes priority over interval.
    ActiveEnables the task.
    CommentOptional notes.
    Note

    An engine only inspects credentials that are stored in JumpServer. If an account exists on the asset but has never been added to the inventory, detection cannot see it. Run a discovery task first.

    Figure 2: Create detection task drawer

    Review and resolve results

    Open Detection results after a task has run. The left side is an asset tree with summary counts for the last week, the last month, and pending risks; the table lists Asset, Account, Risk, Pending, and Date created.

    For a pending risk, open the Actions menu in the Pending column and choose the action that matches the finding:

    ActionWhen it applies
    Change passwordWeak, leaked, repeated, expired, or long-time passwords. Rotates the account secret.
    Add account / Change password and addAccounts that exist on the asset but are not yet managed in JumpServer.
    Sync delete selected / Delete accountAccounts flagged as deleted or no longer used.
    ReviewGroup, sudo, or authorized-key changes. Opens the detail view.
    Ignore / ReopenAccepts the risk, or returns a resolved risk to pending.

    From the review view, Close confirms the finding and moves the status to confirmed, while Ignore alert marks it ignored. To handle several findings at once, select the rows and choose Resolve selected.

    Detection engines

    The Detection engines tab lists the engines available in the current environment:

    EngineWhat it checks
    Check the strength of your account passwordPassword strength and whether the credential appears to be exposed.
    Check whether account and password are repeatedWhether the same username and password are reused by another account.
    Check whether the account password is a common passwordWhether the password appears in lists of commonly leaked passwords.

    Enabled engines are selected per task, so you can run a lightweight strength-only check daily and a full check on a weekly schedule. Review the result list periodically; a clean run does not prove that every asset account is healthy, only that the managed credentials passed the selected checks.