--- schema_version: "1" id: 322ec521d08e1610dcdc3ea9f32b5855c91b2218c970b61aff1c1de6af77e895 title: How the Discovery Application Connects Salesforce and Target Systems collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/service/264-0-0/it_srvcs_discovery_app_communication.md canonical_url: https://help.salesforce.com/s/articleView?id=service.it_srvcs_discovery_app_communication.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: 510a8c9966a1c35a7e7781e53c1a7634c705589b76edaa9c16ca9b5cf9d08269 description: Keep asset data in CMDB accurate and current with reliable agentless scans. Understand how the Discovery Application receives scan instructions from Salesforce, collects asset details from target systems through supported protocols, and returns scan results to Salesforce for processing. Use this communication flow to plan network access. products: - Service Cloud - Agentforce IT Service release: "264" --- # How the Discovery Application Connects Salesforce and Target Systems Keep asset data in CMDB accurate and current with reliable agentless scans. Understand how the Discovery Application receives scan instructions from Salesforce, collects asset details from target systems through supported protocols, and returns scan results to Salesforce for processing. Use this communication flow to plan network access. ### Required Editions
Available in: Lightning Experience
Available in: Enterprise, Performance, and Unlimited Editions with Agentforce IT Service that have Discovery enabled.
The Discovery Application runs on a Windows host in your environment and is the scanning engine for agentless discovery. A scan job uses the targets, probes, and credentials that you configure in Salesforce to define which systems to scan and how to connect to them. The Discovery Application performs the scans and returns the collected asset data to Salesforce for processing in Configuration Management Database (CMDB). ## Communication with Salesforce The Discovery Application initiates an outbound HTTPS connection on port 443 to Salesforce. Through this connection, the application receives scan instructions and sends scan results to Salesforce. Plan persistent outbound access from the Discovery Application host so that scheduled and on-demand scan jobs can run and return results. Salesforce processes the returned data and uses identification rules to match discovered assets with existing configuration items (CIs). When Salesforce finds a match, CMDB updates the CI with the latest discovered data. When no match exists, CMDB creates a CI. This flow helps keep infrastructure data current without manually maintaining each record. For more information about identification rules, see [Identification Rules in CMDB](https://help.salesforce.com/s/articleView?id=service.it_srvcs_cmdb_iden_rules.htm&release=264.0.0&type=5 "Maintain clean and reliable asset records in Configuration Management Database (CMDB) by using identification rules. Determine how the system identifies configuration items (CIs) when new data is added, either manually or through discovery. By matching key attributes like serial number or MAC address, identification rules prevent duplicates, reduce confusion, and ensure the right CI record gets updated."). ## Communication with Target Systems For targets that the Discovery Application can reach, the application initiates connections from its Windows host. The probe that you select for a target determines the protocol that Discovery uses. Discovery uses these protocols for supported target systems: - Windows Management Instrumentation (WMI) or PowerShell Remoting for Windows - Secure Shell (SSH) for Linux and macOS - Simple Network Management Protocol (SNMP) for network devices - HTTPS APIs for virtualization targets Supported cloud discovery uses provider APIs over HTTPS to collect platform-level resource data. To collect operating-system details from a cloud virtual machine, use an agentless or agent-based scan in addition to cloud discovery. Each connection uses the credentials that are associated with the target. Network and security teams can use the target type and probe to identify the required access before scans begin. ## Credential Security Salesforce stores discovery credentials as Named Credentials in your Salesforce org. Credentials aren't accessible from other Salesforce orgs and are encrypted at rest by using a key management service (KMS). Before Salesforce transmits a credential, it decrypts the credential on the server and encrypts it with the public key that is unique to the Discovery Application instance. The credential is transmitted over TLS, and only that Discovery Application can decrypt it with its private key. During a scan, the application holds the credential in memory only and doesn't write it to disk or logs. The Discovery Application uses its application secret to obtain an access token for its connection to Salesforce. To rotate the application secret, reinstall the Discovery Application. ![Example](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-service-it_service-264-0-0-production-enus/0a574a10-4c7a-4681-aacf-0767f8beaad4/images/icon_example.png) Example Agentless Discovery Across a Data Center An IT operations team installs the Discovery Application on a Windows host that can reach its data center. Salesforce sends a scan job to the application over the outbound HTTPS connection. The application uses WMI to scan Windows servers, SSH to scan Linux servers, and SNMP to scan network devices. The application returns the collected data to Salesforce, where CMDB creates or updates the corresponding CIs.