Agentless Discovery

Prerequisites

• User role with discovery.view (read) or discovery.manage (write/execute)
• At least one managed host with a running agent in the target network to serve as a probe host
• For SSH discovery: a PAM Identity credential with SSH access to targets
• For WinRM discovery: a PAM Identity credential with WinRM access to targets
• For network scans: no credentials required (TCP port scan only)

Understanding Discovery

Discovery scans run inside the customer network, not from the SaaS backend. You designate a managed host as a probe, and the platform dispatches a scan job to that host. The agent performs the scan from inside the network and reports results back.

This architecture means the backend never needs direct network access to customer infrastructure. The probe host does all the work.

Discovery Types

Discovery Host Statuses

Configuring Discovery Scans

Create a discovery job that defines the target ranges, protocol, probe host, and optional schedule.

Create a Discovery Job

1. Navigate to Discovery > Create Job.
2. Provide the required fields:

The job is created in pending status. If a schedule is provided, the next run time is computed automatically.

Update or Delete a Job

• Open the job detail page to edit the name, targets, schedule, credential, or other settings.
• Use the Delete button to remove the job definition.
• Neither operation is allowed while the job is currently running.

Running Discovery Scans

Manual Execution

1. Open the discovery job and click Run Now.
2. The platform verifies the probe host is configured and not already running a scan.
3. A scan job is dispatched to the probe host.
4. The agent scans target ranges from inside the customer network.
5. Results arrive asynchronously. Refresh the job detail page to check status.

Scheduled Execution

Jobs with a cron schedule that are enabled are picked up by the scheduler every 5 minutes. When the next scheduled run time has passed and the job is not already running, the scheduler dispatches it automatically. After completion, the next run time advances to the next cron interval.

Job State Machine

Reviewing Discovered Devices

1. Navigate to Discovery > Discovered Hosts to view all discovered hosts.
2. Filter results by discovery job, status (discovered/managed/ignored), OS type, or search by IP/hostname/FQDN.
3. Each record includes: IP address, hostname, FQDN, OS type/version, MAC address, open ports, system info, and last seen time.
4. Click a host row for full detail on a single discovered device.

When a discovery scan re-runs, existing hosts (matched by job and IP address) are updated in place rather than duplicated. New IPs create new records in "discovered" status.

Promoting to Managed Hosts

Promotion moves a discovered host into your managed inventory so it can receive policies, monitoring, and agent installation.

1. Select a discovered host and click Promote. Optionally choose a target location.
2. If the hostname matches an existing managed host in the same org, the discovered host is linked to it (no duplicate created).
3. Otherwise, a new managed host record is created in offline status (no agent yet).
4. The discovered host's status changes to "managed" and is linked to the host record.
5. To make the promoted host fully managed, install an agent on it.

Ignore, Unignore & Delete

IP Range Management

Target ranges are specified per discovery job and support multiple formats:

• CIDR notation — 192.168.1.0/24 (scans 254 addresses)
• IP ranges — 10.0.0.1-10.0.0.50 (scans 50 addresses)
• Single hosts — 10.0.0.1 or fileserver.corp.local
• Mixed — combine any of the above in the target_ranges array

Keep ranges focused on specific subnets or VLANs. Scanning large /16 or /8 ranges will generate enormous job payloads and long runtimes.

Discovery Dashboard

The Discovery Dashboard provides a summary view of all discovery activity. Optionally filter by organization.

Permissions Reference

Troubleshooting