Keep asset data in CMDB accurate and current with reliable agentless scans. Understand how the Discovery Application receives scan instructions from Salesforce, collects asset details from target systems through supported protocols, and returns scan results to Salesforce for processing. Use this communication flow to plan network access.
Required Editions
| Available in: Lightning Experience |
| Available in: Enterprise, Performance, and Unlimited Editions with Agentforce IT Service that have Discovery enabled. |
The Discovery Application runs on a Windows host in your environment and is the scanning engine for agentless discovery. A scan job uses the targets, probes, and credentials that you configure in Salesforce to define which systems to scan and how to connect to them. The Discovery Application performs the scans and returns the collected asset data to Salesforce for processing in Configuration Management Database (CMDB).
Communication with Salesforce
The Discovery Application initiates an outbound HTTPS connection on port 443 to Salesforce. Through this connection, the application receives scan instructions and sends scan results to Salesforce. Plan persistent outbound access from the Discovery Application host so that scheduled and on-demand scan jobs can run and return results.
Salesforce processes the returned data and uses identification rules to match discovered assets with existing configuration items (CIs). When Salesforce finds a match, CMDB updates the CI with the latest discovered data. When no match exists, CMDB creates a CI. This flow helps keep infrastructure data current without manually maintaining each record. For more information about identification rules, see Identification Rules in CMDB.
Communication with Target Systems
For targets that the Discovery Application can reach, the application initiates connections from its Windows host. The probe that you select for a target determines the protocol that Discovery uses.
Discovery uses these protocols for supported target systems:
- Windows Management Instrumentation (WMI) or PowerShell Remoting for Windows
- Secure Shell (SSH) for Linux and macOS
- Simple Network Management Protocol (SNMP) for network devices
- HTTPS APIs for virtualization targets
Supported cloud discovery uses provider APIs over HTTPS to collect platform-level resource data. To collect operating-system details from a cloud virtual machine, use an agentless or agent-based scan in addition to cloud discovery. Each connection uses the credentials that are associated with the target. Network and security teams can use the target type and probe to identify the required access before scans begin.
Credential Security
Salesforce stores discovery credentials as Named Credentials in your Salesforce org. Credentials aren't accessible from other Salesforce orgs and are encrypted at rest by using a key management service (KMS).
Before Salesforce transmits a credential, it decrypts the credential on the server and encrypts it with the public key that is unique to the Discovery Application instance. The credential is transmitted over TLS, and only that Discovery Application can decrypt it with its private key. During a scan, the application holds the credential in memory only and doesn't write it to disk or logs.
The Discovery Application uses its application secret to obtain an access token for its connection to Salesforce. To rotate the application secret, reinstall the Discovery Application.
An IT operations team installs the Discovery Application on a Windows host that can reach its data center. Salesforce sends a scan job to the application over the outbound HTTPS connection. The application uses WMI to scan Windows servers, SSH to scan Linux servers, and SNMP to scan network devices. The application returns the collected data to Salesforce, where CMDB creates or updates the corresponding CIs.