Discovery run types

There are three types of discovery runs:

• Open—one shot dynamically extendable list of endpoints
• Snapshot—one-shot fixed list of endpoints
• Scheduled—repeating fixed list of endpoints

Open discovery run

An open discovery run is a one-shot, extendable list of endpoints to scan. When an open discovery run is created the scan starts immediately. Unlike snapshot and scheduled discovery runs, an open scan can be extended with additional endpoints.
It is possible to add any number of endpoints to an open discovery run until midnight (appliance local time) on the same day the open discovery run was created.
Adding additional endpoints after midnight creates a new open discovery run. An open discovery run is completed when all the endpoints it contains have been scanned and the time is after midnight. Open discovery runs eliminate the need for Discovery to have many small snapshot scans. You can create open discovery runs by using the TPL function discovery.scan.

For information about performing an open discovery run, see discovery.scan.

Snapshot discovery run

A snapshot discovery run is a one-shot, non-editable list of endpoints to scan. The scan starts immediately and runs to completion. You can create snapshot discovery runs by using the UI, tw_scan_control or the external REST API.

The following image illustrates the process flow of a snapshot scan:

• To perform a snapshot discovery run of IP addresses or ranges
• To perform a snapshot cloud discovery run

Scheduled discovery run

A scheduled discovery run is a scheduled repeating list of endpoints to scan. The schedule and endpoints may be modified, though this cancels any associated active discovery run. A scan starts at the time given in the schedule. If the run completes within the scheduled time, the run waits for the next scheduled window to start again. If the run fails to complete within the scheduled time, the run continues from where it stopped at the next scheduled window. If all of the remaining endpoints have started scanning, and there is sufficient time in the schedule, a new discovery run will start. Thus it is possible to have multiple active discovery runs associated with a scheduled discovery run.

Scheduled discovery runs can be created by using the UI or tw_scan_control.

The following image illustrates the process flow of a scheduled scan:

For information about scheduled discovery runs by using the UI, see To schedule a discovery run.