Home / Discovery
DISCOVERY

Discovery

Discovery reduces blind spots by combining network/TLS certificate observation with Discovery Agent for internal environments and, when enabled, local cryptographic discovery.

On this page1. Two complementary paths2. Network/TLS Discovery3. Scan types and scope4. Jobs and results5. Discovery Agent6. Local cryptographic discovery7. Inventory integration8. Troubleshooting

1. Two complementary paths

Network/TLS Discovery scans authorized domains, IP addresses and networks to identify TLS services and certificates actually observed.

Discovery Agent runs scans from inside customer networks to reach private environments. It can also perform local cryptographic discovery when that capability is enabled.

Certificate/TLS scanning and local cryptographic discovery are separate processes. A crypto-collection problem does not turn an already completed TLS scan into a failed scan.

2. Network/TLS Discovery

Use Quick Scan for a one-time investigation or a persistent Discovery configuration for a scope that should be saved, rerun or scheduled.

Depending on scan type, targets can be domains, IP addresses or CIDR networks. TLS ports and execution limits keep workload and scope controlled.

3. Scan types and scope

Include only targets your organization is authorized to assess. Start with a limited scope and expand it after validating routing, firewalls and response times.

4. Jobs and results

A job exposes status, progress, targets scanned, certificates found, new certificates, errors and log events.

Each TLS result retains observation context such as target, port, target type, status and certificate data when a usable service is encountered.

5. Discovery Agent

Discovery Agent is intended for private networks and services not directly reachable from the SaaS service. It establishes outbound HTTPS connectivity to Ecurem CLM and runs assigned scans locally.

See Discovery Agent documentation.

6. Local cryptographic discovery

When Enable local cryptographic discovery is selected, Discovery Agent analyzes configured locations with its local collector and produces a CBOM document.

The Agent verifies that the document is CycloneDX 1.7, sanitizes metadata defined as sensitive, and places the result in a local queue before submission.

If the platform is temporarily unavailable, the CBOM can remain queued and be delivered after connectivity returns.

7. Inventory integration

TLS and certificate observations can enrich the standard Inventory. Validated and normalized CBOM observations feed the organization’s Cryptographic Inventory.

See Inventory. · See Cryptographic Inventory.

8. Troubleshooting