Salesforce Docs Portal

Prepare the Discovery Application Host for Agentless Scans

Run reliable agentless scans and keep asset data in CMDB current by preparing a Windows host for the Discovery Application. Provide outbound access to Salesforce, protocol-specific access to target systems, and a service account with local administrator access. Verify connectivity so the application can run scan jobs and return results for processing.

Required Editions

Available in: Lightning Experience
Available in: Enterprise, Performance, and Unlimited Editions with Agentforce IT Service that have Discovery enabled.
User Permissions Needed
Manage Discovery Application IT Service Asset Discovery

The Discovery Application uses an outbound HTTPS connection to Salesforce and protocol-specific connections to target systems. For more information, see How the Discovery Application Connects Salesforce and Target Systems.

Use a Discovery Application host that meets these requirements:

  • Windows Server 2019 or later. Windows Server 2022 is recommended.
  • An x86-64 processor with 12 to 16 CPU cores. ARM-based processors, including AWS Graviton processors, aren't supported.
  • 16 GB of RAM.
  • 50 GB of disk space.
  • Google Chrome.

Prepare the Windows host before you install the Discovery Application. The host location, network access, and service account determine which target systems the application can reach and scan.

  1. Choose a dedicated physical or virtual Windows host that stays powered on and connected to the network.
  2. Place the host in the network domain that contains the target systems.
    To scan target systems in another domain, work with your network and security teams to establish the required trust between the domains.
  3. Allow persistent outbound HTTPS traffic on port 443 from the host to Salesforce.
  4. Allow protocol-specific traffic from the host to each target network.

    The selected probes determine the required access:

    • Windows Management Instrumentation (WMI) or PowerShell Remoting for Windows
    • Secure Shell (SSH) for Linux and macOS
    • Simple Network Management Protocol (SNMP) for network devices
    • HTTPS APIs for supported virtualization targets
  5. Create or identify the Windows account that the Discovery Application service uses.
    Grant the account local administrator access on the Discovery Application host. The service uses this account to initiate connections to target systems. After you install the Discovery Application, configure the Salesforce Discovery Application Windows service to run with this account, and then restart the service.
  6. If you plan to use PowerShell Remoting scans, turn on Windows Remote Management (WinRM) on the Discovery Application host.

    Run this PowerShell command as an administrator:

    Enable-PSRemoting -Force

    To verify that WinRM is running and starts automatically, run:

    Get-Service WinRM | Select-Object Status, StartType
  7. Verify that the host can connect to Salesforce and to a representative target in each network segment that you plan to scan.

Download and install the Discovery Application on the prepared host. For more information, see Download and Install the Discovery Application.