Scheduling discovery

You can choose times and frequencies for performing discovery, whether the discovery is for normal or cloud scans. The cloud scan is different from other scan types as it simply retrieves information from the cloud provider API. 

Related topics

Excluding ranges from discovery

Rescanning scan results

Examining scan results

To schedule a discovery run, perform the following steps:

  1. On the Manage > Discovery page, click Add New Run. 
  2. Select Scheduled.
    The dialog displays Public, Frequency, Start, and End menus.
  3. Set the schedule fields as described in the following table and click OK.
    The Scheduled Runs tab is displayed with the new scheduled discovery run.

To add another scan to the page, click Add New Run. 
To delete any existing scheduled scans, select the entry and click Delete.

The table below describes explanation of all the fields that are required either for normal scan or cloud scan:

Field name

Details

Label

Enter a label for the discovery run. Where the discovery run is referred to in the UI, it is this label that is shown.

Timing

Select the timing for the discovery run. This is either:

  • Snapshot — Enter information for scan to occur in a snapshot view.
  • Scheduled — Enter information for the scan to occur at any time and for a specified amount of time.

Targeting

Select the target for the discovery run. This is either:

  • IP Address — Enter IP address information.
  • Cloud — Enter cloud provider information.

Range

Enter IP address information in one of the following formats:
• IPv4 address (for example 192.168.1.100). Labelled v4.
• IPv6 address (for example 2001:500:100:1187:203:baff:fe44:91a0). Labelled v6.
• IPv4 range (for example 192.168.1.100-105, 192.168.1.100/24, or 192.168.1.*). Labelled v4.

Note

Scanning the following address types is not supported:
• IPv6 link local addresses (prefix fe80::/64)
• IPv6 multicast addresses (prefix ff00::/8)
• IPv6 network prefix (for example fda8:7554:2721:a8b3::/64)
• IPv4 multicast addresses (224.0.0.0 to 239.255.255.255)

As you enter text, the UI divides it into pills, discrete editable units, when you enter a space or a comma. According to the text entered, the pill is formatted to represent one of the previous types or presented as invalid.

For more information, see here.

Invalid pills are labeled with a question mark. You can also paste a list of IP addresses or ranges into this field. If any pills are invalid, a message stating the number of invalid pills is displayed above the range field. Clicking the link applies a filter which shows only invalid pills which you can then edit or delete. The filter can be removed by clicking clear in the Showing n of n label below the Range field. There is no paste option on the context sensitive (right click) menu.
Warning: You cannot paste a comma-separated list of IP address information into the Range field in Firefox. This can crash the browser. You can use a space separated list without any problems.
• To edit a pill, click the pill body and edit the text.
• To delete a pill, click the X icon to the right of the pill, or click to edit and delete all of the text.
• To view the unformatted source text, click the source toggle switch. The source view is useful for copying to a text editor or spreadsheet. Click the source toggle switch again to see the formatted pill view.
Underneath the entry field is a filter box. Enter text in the filter box to only show matching pills.

ℹ️ Pills are not currently supported in Opera.

Level

Select the level for the discovery run. This is either:

  • Full Discovery — Retrieves all the default info for hosts, and complete full inference.
  • Sweep Scan — Performs a sweep scan, trying to determine what is at each endpoint in the scan range. It will attempt to login to a device to determine the device type.

Outpost

(Available only when you select the Targeting type as IP Address.) Select whether you want to perform the scan through an installed Outpost or the local appliance. 

The Outpost list displays only registered and enabled Outposts and the discovery service (local appliance). If you have not installed an Outpost and you scan only through the local appliance, this list does not provide options to choose.

Ping

Select a ping for the discovery run to be performed. This can be:
• Use default
• Ping before scanning
• Do not ping before scanning

Public

(Available only when you select the Targeting type as IP Address.) Select Allow patterns to scan in this range if you want patterns to be able to trigger scans on endpoints in this range.

Frequency

Select a frequency for the discovery run to be performed. This can be:
• Every n hours
• Weekly by days of week
• Once per week
• Monthly by day of month
• Monthly by week of month.

Start

Based on the selected scan frequency, you are presented with different options to start scheduled scans. Discovery must be running at this time.

• Every n hours: From the menus, select the frequency of the scan (every 1, 2, 3, 4, 6, 8, and 12 hours), start times at minutes past the hour, and the hours after which the scan should start.
For example, if a scan is scheduled to occur every two hours, then the starting hours may be 00, 02, 04, and so on, or 01, 03, 05, and so on.
• Weekly by days of week: Using the day buttons, click one or more days. The selected buttons appear with a Yellow border. From the menus, select the start time in hours and minutes.
• Once per week: From the menus, select the day of the week and the start time in hours and minutes.
• Monthly by day of month: From the menus, select the day of the month and the start time in hours and minutes.
• Monthly by week of month: From the menus, select the week, the day of the week, and the start time in hours and minutes.

For example, to start a scheduled weekly discovery run which starts on Friday at 19:30 hrs and continues until Saturday, do the following:

  1. Select the scan frequency as Weekly by days of week.
  2. Click the F and S day buttons.
  3. From the time menu, select 19 hours and 30 minutes.

End

You can choose end a scheduled scan when it is completed by selecting when completed.
Alternatively, use the available option to end the scan which is based on the selected scan frequency. If the end time is reached before the scan has completed, then the scan is suspended until the next scheduled time that the scan occurs.

The scan operation resumes, in a new scan, which starts at the point the on-hold scan was suspended.

• Every n hours: This scan type does not have a scheduled end time; they run to completion.
• Weekly by days of week: You are provided with the drop down menus to select the end time in hours and minutes.
• Once per week: You are provided with the drop down menus to select the day of the week and time to end the scan.
• Monthly by day of month: You are provided with the menus to select the day of the month and time to end the scan.
• Monthly by week of month: You are provided with the drop down menus to the select the number of days and the time within which the scan must end.

For example, to end a scheduled weekly discovery run which starts on Friday at 19:30 hrs and continues until 21 hours 30 minutes on Saturday (see the example for the Start field above), you will select 21 hours and 30 minutes from the time drop down menu.

The following additional fields are required for a cloud scan discovery:

Provider

Specify the type of cloud provider such as Amazon Web Services or Microsoft Azure.

Credentials

The list is automatically populated with the credentials corresponding to the selected cloud provider.

Region

Region to scan.

Where to go from here

Enabling-other-users


 

Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*