There is an internal site running on the monitored host on port 80.
The ports that are used for the connection are controlled by the agents and they are usually hard coded to try all WinRM ports (5985, 5986, 80, 443) in that order.
These ports are hardcoded.
