Improve agentless scan reliability and keep discovered asset data current. Review the connectivity and access requirements for each supported probe before you create discovery targets.
Required Editions
| Available in: Lightning Experience |
| Available in: Enterprise, Performance, and Unlimited Editions with Agentforce IT Service that have Discovery enabled. |
Plan Network Access
Before you create a discovery target, work with your network, security, and infrastructure teams to allow the connections that apply to the selected probe and target systems. If your environment uses a third-party or centrally managed firewall, create equivalent rules in the firewall management console.
The Discovery Application initiates agentless connections from its Windows host to reachable target systems. For more information about this communication flow, see How the Discovery Application Connects Salesforce and Target Systems.
Network Connections
Allow each connection from the listed source to the destination. Limit firewall rules to the Discovery Application host and target systems that are included in your scan scope.
| Connection | Source | Destination | Direction | Protocol and Port | Purpose |
|---|---|---|---|---|---|
| Salesforce communication | Discovery Application host | Salesforce | Outbound | HTTPS over TCP port 443 | Receive scan instructions and return scan results for processing. |
| Azure cloud API discovery | Salesforce | Microsoft Azure APIs | Outbound | HTTPS over TCP port 443 | Collect Azure resource data by using the configured service principal. |
| Host reachability check | Discovery Application host | Target systems | Outbound | ICMP echo request | Identify reachable hosts before the Discovery Application runs a network scan. |
| WMI scan | Discovery Application host | Windows target | Outbound | TCP ports 135, 139, and 445, and TCP ports 49152 to 65535 | Use RPC endpoint mapping, dynamic RPC, and SMB to collect Windows inventory data. |
| PowerShell Remoting scan | Discovery Application host | Windows target | Outbound | WinRM over TCP port 5985 for HTTP or TCP port 5986 for HTTPS | Collect Windows inventory data by using PowerShell Remoting. |
| SSH scan | Discovery Application host | Linux, Unix, or macOS target | Outbound | SSH over TCP port 22 | Collect operating system, hardware, software, and configuration data. |
| SNMP scan | Discovery Application host | Network device | Outbound | SNMP over UDP port 161 | Collect standard and manufacturer-specific device inventory and configuration data. |
| VMware vCenter scan | Discovery Application host | VMware vCenter Server | Outbound | HTTPS over TCP port 443 | Collect virtual machine, host, datastore, and related virtualization data. |
Authentication and Target Access
Use credentials that provide the access required by the selected probe. Coordinate with each target system owner to apply your organization's access and credential policies.
| Target and Probe | Authentication | Required Access | Target Configuration |
|---|---|---|---|
| Windows with WMI | Windows local or domain account | Local administrator access on the target | Allow remote WMI access from the Discovery Application host. |
| Windows with PowerShell Remoting | Windows local or domain account | Membership in the Administrators and Remote Management Users groups on the target | Turn on Windows Remote Management on the Discovery Application host and the target. |
| Linux or Unix with SSH | Username and password or SSH key | SSH access and sudo access for hardware-level details | Turn on SSH access on the target. |
| macOS with SSH | Username and password or SSH key | Access to run system_profiler |
Turn on Remote Login and grant access to the scanning account. |
| Network device with SNMP | SNMP v2c community string or SNMP v3 username and authentication settings | Read-only access to the full MIB, including the system MIB and the manufacturer’s enterprise MIB | Turn on SNMP on the target device. |
| VMware vCenter Server | VMware vSphere credentials | Read-only access to the vCenter inventory | Allow HTTPS connectivity from the Discovery Application host. |
For more information about adding authentication details in Salesforce, see Create Discovery Credentials for Secure Scanning. For more information about selecting a probe and configuring a target, see Configuration Fields for Target Categories and Probe Types.