Install on a Linux host
The supported deployment of self-hosted ShakerScan Enterprise, Docker Compose on one Linux host you operate, from requirements through install, start at boot, firewall, backup and restore, and upgrade.
Enterprise documentation
Run ShakerScan on your own infrastructure.
Guides for the people who install and operate self-hosted ShakerScan Enterprise and for the people who use it: the Linux host, single sign-on, connecting an agent, recurring scans, retests and Jira, and what a security review needs to know.
Looking for the open-source engine? Open-source documentation. Evaluating Enterprise? What it is and how a pilot works.
Getting started
Identity
Single sign-on with Okta
Step-by-step Okta setup for ShakerScan Enterprise (OpenID Connect with PKCE, group-to-role mapping), with the two mistakes that are easy to make and how to recognize them.
Single sign-on with Microsoft Entra ID
Setting up Microsoft Entra ID (OpenID Connect with PKCE, group-to-role mapping, re-authentication) for ShakerScan Enterprise with the console's Entra ID preset.
Hunt
Hunt in Enterprise
What Hunt is, who can use it, how an administrator turns it on, the four ways to run it (browser, an agent over MCP, scripts, the autonomous Hunt with your model), token hygiene, and what the beta leaves out.
Work with an agent (Claude Code, Codex, OpenCode)
Two commands on a laptop, connect and agent, give you the same ShakerScan agent workspace the open-source launcher provides, against your Enterprise instance, with every action under your identity.
Record a browser session (shakerscan record)
Sign in and browse a target in a recorded browser on your laptop; the requests reach your Enterprise instance as a browser capture that Scans, Hunts and your agent use like an imported HAR file.
Operations
Recurring scans
Schedule a web scan daily, weekly or monthly at a local time in the console or from a terminal; how runs share the licensed slots, what happens when a run cannot start, the evidence export for auditors, the status endpoint for monitoring, and backup.
Jira tickets for findings
Connect Jira Cloud or Data Center, map the project, issue type, priorities and fields, create one ticket per finding from the console or a terminal, and let a retest that proves the fix comment on and close the ticket.
Retests and fixes
Retest one finding or many, let a retest that proves a fix close the finding, see a closed finding reopen when a later scan finds it again, compare a scan with the one before it, track each open finding's age against an SLA per severity, and export the evidence.
Scheduled scans
Run a scan every week (or on any schedule) with a systemd timer on the deployment host and a service token, see every failure in the journal and on the health card, and renew the token before it expires.
Reference
Security overview
What runs where, what leaves your network and what the vendor holds, identity and access, request handling, audit, secrets, licensing and supply chain, for a procurement or security review.
Security-key touch: reference
The details behind the switch that requires a security-key touch for person decisions from terminals, including what each summary names, what the gateway writes, the limits, keys, the terminal client and rollback.
Something missing or unclear? Write to us.