Network Discovery

Scope

Discovery should clarify the environment instead of creating another doubtful asset list. This guide keeps the operator-facing discovery model and excludes private scanning mechanics.

Understanding the Probe-Based Model

Cadres is a cloud-hosted SaaS platform and cannot directly reach devices on your network. All discovery scans are executed by a probe endpoint – a managed endpoint running the Cadres agent inside your network. The probe endpoint must:

• Have an active Cadres agent installed and registered
• Be on the same network segment as the devices you want to discover
• Be online and reachable by the Cadres backend

Automatic Subnet Discovery and Probe Election

When an agent registers, Cadres automatically:

1. Reads the endpoint’s network interfaces to determine which subnets it can reach
2. If the subnet has no existing probe, elects the newly registered agent as the probe
3. If auto-bootstrap is enabled (default), creates a weekly discovery job for the subnet

This means discovery often requires zero manual configuration – just install agents.

To check which subnets are registered and their probe assignments:

To disable auto-bootstrap for an organization:

• Create or update a DiscoveryPolicy for the org with auto_bootstrap_enabled=false

Creating a Manual Discovery Job

Discovery types:

• network_scan – Ping sweep + port scan. No credentials required.

Credential selection (UI):

• SSH/WinRM credential: Dropdown populated from PAM vault identities. Required for ssh and winrm discovery types.
• SNMP credential: Separate dropdown for SNMP v2c/v3 identities. When set, endpoints discovered with SNMP-capable ports are automatically provisioned as SNMP devices.

Probe endpoint selection (UI):

• Searchable dropdown of online agent endpoints in the selected organization.
• Server-side search by hostname/FQDN — no silent truncation at scale.
• When target ranges are entered, probes whose registered subnet covers the target are ranked first and labelled “(subnet match)”.
• The probe should be on the same network as the target ranges for the scan to reach the targets. The UI provides subnet-aware ranking hints but does not enforce reachability.

Network organization context (UI):

• The Network Discovery workspace includes a Network Organization selector.
• Jobs, endpoints, and subnet views are scoped to the selected organization.
• New jobs default to that same selected organization, so probe/credential choices stay tenant-bound.

Schedule format: Standard 5-field cron expression (UTC). Leave null for manual-only jobs.

Running a Discovery Scan

Preconditions:

• Probe endpoint must be configured and have an active agent (400 error)
• SSH/WinRM jobs must have a credential configured (400 error)

Dashboard

Shows total jobs, active scheduled jobs, and three breakdown panels:

• By Lifecycle State: Full 7-state breakdown (discovered/linked/managed_pending_agent/deploying_agent/managed/ignored/stale) with color-coded bars
• By OS Type: Linux, Windows, Unknown counts
• Recent Discoveries: Last 10 endpoints with lifecycle state badges

Organization scope: Org-restricted users see only data from their assigned organizations. Account admins see all organizations. The dashboard applies perms.get_org_filter() to both job and endpoint queries.

Permissions Reference

Permission	Operations
discovery.view	List/view discovery jobs, discovered endpoints, lifecycle history, dashboards
discovery.manage	Create/update/delete discovery jobs; run scans; promote/ignore/unignore endpoints; retry deploy; bulk ignore/unignore

Subnet Visibility

Lists all registered subnets for accessible organizations. Each entry includes:

Field	Description
cidr	Subnet CIDR (e.g. 192.168.1.0/24)
gateway	Gateway IP address
endpoint_count	Number of endpoints assigned to this subnet (accurate COUNT query)

Use this endpoint to verify which subnets have been auto-detected, confirm probe assignments, and identify subnets without active probes.

Requires: discovery.view permission.

Cross-References