AttackTracer Ninja Server

Legacy: This document describes the older share/server architecture. The recommended direction is now the V2 client + n8n + Postgres model documented in attacktracer-ninja-v2-architecture.md.

Purpose

AttackTracerNinjaServer is the central companion package for one designated server.

It is separate from the normal endpoint client and is responsible for:

reading mirrored JSON reports from the network share
building the consolidated HTML report
updating NinjaOne organization custom fields through the NinjaOne API

Separation of roles

Endpoint client

Install the standard AttackTracerNinja package on all monitored systems.

Use it to:

scan local logs
write device custom fields
mirror JSON reports to the central share

Server package

Install AttackTracerNinjaServer on exactly one central server.

Use it to:

read \\share\*.json
generate attacktracer-org-report.html
update:
- attacktracerorgstatus
- attacktracerorgsummary
- attacktracerorglastupdate
optionally update attacktracerorgreport through the API

Installer

Build output:

artifacts\AttackTracerNinjaServerSetup.exe

During installation, the server installer prompts for:

Ninja base URL
organization ID
OAuth client ID
OAuth client secret
OAuth scope
reports share path
HTML output path
target org field names

Suggested OAuth scope default:

monitoring management

Runtime command

Installed command:

& "C:\Program Files\AttackTracerNinjaServer\scripts\run-attacktracer-ninja-server.ps1"

OAuth requirements

Use a NinjaOne API client with at least:

Monitoring
Management
Client Credentials

Relevant official references:

2.1 KiB Raw Blame History