What leaves the appliance
Design rule G2: the appliance never contacts GigID Labs. There is no telemetry, no license check, no update check and no vendor endpoint. Integrations refuse any host under gigidlabs.com (ALERT_DEST_VENDOR_REFUSED) and ignore proxy settings from the environment.
Every outbound connection
Section titled “Every outbound connection”| Connection | When | To where | Logged as |
|---|---|---|---|
| SNMP reads (UDP 161) | every poll | the sources an Admin added | poll_rollup every hour, poll_run when a poll’s result changes, and config_change when a source is added |
| Network check | during setup | one reverse DNS lookup for the gateway, through the operating system’s resolver | the setup step |
| Scan my network | only when a person starts it | the attached subnet; reverse DNS through the resolver (the consent text says those lookups leave the network if the resolver is outside it) | the scan, with the hash of the consent text |
| Integrations | alerts and the audit stream | only destinations an Admin configured: syslog, Splunk, Microsoft Sentinel, Teams, Slack, email relay, ticketing, webhooks, PagerDuty (events.pagerduty.com or events.eu.pagerduty.com only) and SNMP informs or traps to your NMS |
config_change (every non-secret setting and host), alert_delivered |
| Microsoft Graph | only for an Entra ID or Intune list set to pull, on demand | the customer’s own tenant, on the chosen cloud’s sign-in and Graph hosts only | reconcile_import, config_change |
| Files people download | evidence packs, Rewind answers, board reports, exports | the person’s browser | pack_exported, answer_issued, board_report_exported, list_exported, each with a SHA-256 |
Nothing else. The Graph client refuses redirects and stops a pull whose paging link points to another host. Integration clients never follow redirects.
Inbound
Section titled “Inbound”Only the web interface: HTTPS on port 8443 by default (appliance appliance), or plain HTTP on 127.0.0.1 in start mode, plus HTTPS on the next port with -lan. It answers only to configured host names. Nothing listens for SNMP traps.
What an examiner can see
Section titled “What an examiner can see”Every outbound destination is an audit entry listing its hosts and settings. The Examiner role can view the integration list and its delivery logs read-only, so what leaves the box is itself evidence.
Planned
Section titled “Planned”Updates and support bundles are designed to move only by a person’s hand: an update uploaded or carried on USB, a support bundle a person chooses to send. Monitoring would be the customer’s or MSP’s own Prometheus scraping the appliance. None of these is built yet.
A GigID Labs cloud console for MSPs and multi-site organizations is launching soon. It is not available today. The appliance never needs the cloud, and everything on this page stays true without it.