Credential and Access Prerequisites

Discover collects inventory data from scanned systems using the credentials in a Keychain. Approval for privileged or service accounts can take weeks in some organizations, so request the access described here as early as possible during deployment planning.

Windows Endpoints

Use a Local Admin or Domain Admin account where possible.

Least-Privilege Service Account

If administrative credentials aren’t available, a service account with the following access is sufficient:

  • Access to the Windows inventory protocols: RPC, SMBv2 or SMBv3, and WMI.
  • Read access to the WMI classes and registry entries the scan uses.

The service account must have permission to read the following WMI classes:

Win32_ComputerSystem            Win32_NetworkAdapter
Win32_ComputerSystemProduct     Win32_NetworkAdapterConfiguration
Win32_SystemEnclosure           Win32_Process
Win32_BIOS                      Win32_Service
Win32_OperatingSystem           MSCluster_Cluster
Win32_Processor                 MSCluster_Resource
Win32_PhysicalMemory            MSCluster_ClusterToNode
Win32_DiskDrive                 MSCluster_ClusterToResource
Win32_DiskDriveToDiskPartition  Msvm_ComputerSystem
Win32_LogicalDiskToPartition    Msvm_VirtualSystemSettingData
Win32_LogicalDisk

It also needs permission to run type and netstat.

Network and Firewall Tips

  • Confirm the appliance can reach the ports listed in Network prerequisites for scanning (RPC, SMB, WMI, Remote Registry).
  • Add firewall and ACL exclusions for the appliance’s IP address before scanning — for example, by pushing a GPO exclusion to target endpoints.

Unix / Linux Endpoints

The service account must have sudo or elevated privileges, a shell, and a home directory. Both password and SSH key authentication are supported.

Required Commands

To scan with least privilege, the account needs permission to run the following commands via sudo:

Command Purpose
cat Reading file content
dmidecode Collecting host data
docker Collecting Docker container data
fdisk Collecting disk data
getconf Identifying process command-line truncation
groups Collecting user group membership
ip netns exec Identifying container communications
ls Directory exploration
lshw Disk data collection
netstat Collecting communication data
nsenter Inspecting container network namespaces
pfiles Collecting process communication data
pwdx Identifying a process’s working directory
rm Cleaning up files created while scanning Docker
runuser Collecting Oracle Database data
ss Identifying process command-line truncation

Solaris, AIX, and HP-UX

These platforms are supported for inventory.

Platform Extra Commands Notes
Solaris format, ls, lsof, pargs Uses sneep, dmidecode, hostid, and smbios to derive a unique identifier; sudo may not be preinstalled on Solaris 10. Non-global zones can’t see global disk information, which shows as a partial scan — this is expected.
AIX lscfg, lsof, bootinfo, getconf, lspv Requires lsof or netstat.
HP-UX cstm, getconf, lsof, netstat, print_manifest Requires lsof or netstat.

If a target’s OS commands can’t produce a unique identifier, the scan still completes, with a warning. Move affected targets into their own scan job and enable Generated Device Identifier under Scan job options to use a generated identifier instead.

Network and Firewall Tips

  • Confirm the appliance can reach target systems on TCP port 22 (SSH) — see Network prerequisites for scanning.
  • Add firewall and ACL exclusions for the appliance’s IP address before scanning.

AWS SSM (EC2 Linux)

To scan Linux EC2 instances using AWS Systems Manager instead of direct SSH, use an AWS IAM credential (access key ID and secret access key) with the following permissions:

  • ssm:SendCommand
  • ssm:ListCommandInvocations
  • ssm:DescribeInstanceInformation

With credentials in place, Add them to a keychain and use it in the scan job.