Network & firewall
Allow only the connectivity required for SaaS access and, where enabled, local Discovery Agent scans.
On this page1. SaaS access2. Discovery Agent3. Target flows4. DNS/time5. Proxy/filtering6. Checklist
1. SaaS access
User workstations need DNS resolution and outbound HTTPS/443 access to clm.ecurem.cloud.
2. Discovery Agent
The Agent uses outbound HTTPS to communicate with Ecurem CLM. Arbitrary inbound Internet exposure is not required.
3. Target flows
For local scans, the Agent initiates connections to approved targets on configured scan ports. These are destination ports, not inbound ports for the SaaS service.
4. DNS/time
DNS resolution is required; reliable system time/NTP is strongly recommended for TLS, logs and authentication.
5. Proxy/filtering
If a proxy or allowlist is used, document the required SaaS and target flows. Prefer least-privilege rules over broad network access.
6. Checklist
- SaaS DNS resolution.
- Outbound HTTPS/443.
- Reliable time.
- Agent online.
- Approved CIDRs/FQDNs.
- Approved target ports.
- No unnecessary Agent inbound exposure.