DISCOVERY

Discovery Agent

Discovery Agent extends Ecurem CLM into internal networks: it runs local certificate scans and, when enabled, local cryptographic discovery with controlled CycloneDX 1.7 CBOM submission.

On this page1. When to use the Agent 2. Enrollment 3. Status and heartbeat 4. Local TLS scans 5. Local cryptographic discovery 6. CycloneDX 1.7 CBOM 7. Local queue and reconnect 8. Network and security 9. Troubleshooting

1. When to use the Agent

Use Discovery Agent for private networks, RFC1918 addresses, internal services or segmented environments that are not directly reachable from the SaaS service.

The Agent provides two complementary capabilities: local TLS service/certificate scanning and local cryptographic discovery when enabled.

2. Enrollment

Create an enrollment for the target organization and assign an Agent name. Enrollment credentials are short-lived and single-use. During first registration, the server binds the Agent to the corresponding organization.

Do not reuse expired or consumed enrollment credentials and never place Agent authentication tokens in tickets, screenshots or documentation.

3. Status and heartbeat

The Agent record exposes information such as name, organization, version, interfaces, status and last communication. Heartbeats maintain online/offline visibility.

4. Local TLS scans

Local scan configurations belong to an Agent. Configure only CIDRs and ports that are reachable from that machine and belong to the authorized scope.

TLS results can enrich certificate Inventory. This capability remains separate from local cryptographic discovery.

5. Local cryptographic discovery

When Enable local cryptographic discovery is selected, the Agent analyzes configured locations using its local cryptographic collector.

The expected result is a JSON CBOM. The Agent verifies that it is a CycloneDX 1.7 document before processing continues.

A CBOM collection or submission error does not invalidate an already completed TLS scan.

6. CycloneDX 1.7 CBOM

Before submission, the Agent sanitizes the CBOM. Metadata defined as sensitive, including secrets, passwords, tokens, credentials or private-key material, is removed.

The sanitized CBOM is sent to Ecurem CLM. The server validates the document and normalizes its components into the organization’s Cryptographic Inventory while retaining available provenance context.

7. Local queue and reconnect

The sanitized CBOM is placed in a local queue before submission. If Ecurem CLM is temporarily unavailable, the result can remain pending and be delivered after connectivity returns.

8. Network and security

The Agent establishes outbound HTTPS connectivity to Ecurem CLM.
It must reach local targets on configured ports.
Arbitrary inbound exposure is not required for SaaS communication.
Keep CIDRs, ports and discovery locations limited to the approved scope.
Treat enrollment and Agent authentication tokens as secrets.

9. Troubleshooting

Invalid or expired enrollment token: create a new enrollment.
Agent offline: check the local service, DNS, outbound HTTPS and system clock.
No local TLS results: validate routing, firewall, CIDR and target ports from the Agent host.
No cryptographic result: verify the configured location and collector state.
CBOM submission pending: verify connectivity and feature authorization.