Targets

A target is one endpoint you want to watch. Create one from Targets → New.

Common settings

Setting	Meaning
Check type	HTTP/HTTPS, TCP, or ICMP.
Target	URL (HTTP) or host (TCP/ICMP), with an optional port.
Interval	How often the check runs.
Timeout	Per-check deadline; a check that exceeds it is Down.
Retries	A failing check goes Degraded during the retry window (at the separate, faster retry interval) and only flips Down once retries are exhausted — this is what prevents single-blip flapping.
IP version	Force IPv4/IPv6, or Auto.
Inverted mode	Swap Up/Down — the target should not be reachable (e.g. a firewalled port).
Labels	Freeform tags — see Labels below.
Enabled	Toggle a target off without deleting it.
Scouts	One or more Scouts decide where the check runs from.

HTTP/HTTPS options

• Expected status — an explicit code list, a min/max range, or both combined (e.g. 200-210,250,260-270).
• Keyword assertion — Contains / NotContains / Regex against the response body (regex has a ReDoS timeout guard).
• JSON-path assertions — assert a value at a JSON path (Eq/Ne/Contains/Gt/Lt/Exists).
• Request — method (GET/HEAD/POST/PUT/PATCH/DELETE/OPTIONS), custom headers (secret headers are masked in the UI and encrypted at rest), body, content type.
• Auth — Basic or Bearer. Credentials are dropped automatically on a cross-origin/scheme redirect.
• Redirects — follow on/off, with a configurable max hop count.
• TLS — an ignore-cert-errors toggle, plus full chain capture (leaf + intermediates + root, fingerprinted) — sent to the server only when the leaf fingerprint changes (see cert-expiry alerts).
• Degraded latency — responses slower than this threshold report Degraded instead of Up, gated by a configurable per-check Scout quorum before it counts.

TCP options

Port (required), an optional send-string (with \r\n\t\0 escape sequences), plain/TLS/STARTTLS connection, and an Expect / Expect-not response pattern (regex-capable, with a timeout guard). Connect latency is measured separately from the send/expect round-trip.

ICMP options

Ping with a configurable packet count and a packet-loss threshold. Packet size, TTL, and don't-fragment are privileged options — each Scout self-reports whether it can use them, and the UI warns if an assigned Scout lacks the privilege. Without --cap-add=NET_RAW a Scout falls back to an unprivileged datagram socket rather than depending on the system ping binary.

Labels

Attach freeform labels to a target. Labels aren't just cosmetic — they drive:

• Grouping in the target list and UI.
• RBAC scoping — a permission group can be scoped to only the targets carrying a given label (see Users & Groups).
• Audit-log filtering — filter the audit trail down to actions on labelled targets (see Auditing).

As you type in the labels field it suggests labels already in use so you can reuse them consistently; type a new value and press Enter (or comma) to create a brand-new label.

Secrets

Passwords, bearer tokens, and secret headers are encrypted with AES-GCM-256, per-value with a unique nonce (SNITCHER_SECRETS_KEY) and never returned by the API — the UI shows only whether a secret is set, via a sentinel "unchanged" value on edit.

Egress protection (SSRF guard)

Every check (HTTP, TCP, ICMP) and every outbound alert webhook re-resolves its target's DNS at send time and blocks loopback, RFC1918 private ranges, link-local addresses, and cloud metadata endpoints (169.254.169.254, 168.63.129.16) — defeating DNS-rebinding attempts that try to point a "target" at your internal network. See Security.

Multi-Scout consensus (down confirmations)

Set Down confirmations (Common Options) to require a quorum of Scouts before a resource is declared Down: with a value of K, at least K online Scouts must independently report Down (clamped to the number reporting), otherwise it reads as Degraded. A single Scout's local path issue then no longer flips the resource to Down — a false-positive reducer that only Snitcher's self-hosted multi-Scout fleet makes free. Leave it blank for the default (any full outage is Down, a partial outage is Degraded).

Status & history

The dashboard shows the derived status (Up / Down / Degraded / Unknown), a heartbeat strip, uptime percentages, and per-Scout/latency history. Assign multiple Scouts to compare availability by location.