> For the complete documentation index, see [llms.txt](https://docs.guardware.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.guardware.com/discover/about/introduction-to-discover.md).
# Introduction to DISCOVER
## Introduction to DISCOVER
GuardWare DISCOVER is a cross-platform system designed to identify, classify, and manage sensitive data across enterprise environments. It operates across endpoints, file servers, email systems, and cloud services, helping organisations detect and reduce exposure of regulated and sensitive information including PCI, PII, PHI, as well as custom data types.
At its core, DISCOVER is built around a centralised model of control and distributed execution. This allows it to scale across diverse infrastructures, from closed-off, high-security networks to fully cloud-native environments, while maintaining a single point of visibility and administration.
### System Architecture
The system is composed of three primary components that work together: the Management Console, the Scanning Agent, and the Targets being scanned.
{% columns fullWidth="false" %} {% column width="33.33333333333333%" %} {% hint style="info" icon="1" %} **Management Console**\
\
The central web application where scan jobs are scheduled, configurations are stored, and results are reviewed. It provides visibility into scan status, investigations, and remediation options. It can be hosted on-premises or in the GuardWare cloud. {% endhint %} {% endcolumn %}
{% column width="33.33333333333333%" %} {% hint style="info" icon="2" %} **Scanning Agent**\
\
Installed on a device to carry out scan and remediation tasks assigned by the Management Console. Depending on the deployment model, it either scans the device it's installed on, or acts as a Scanning Server that remotely scans other devices. {% endhint %} {% endcolumn %}
{% column %} {% hint style="info" icon="3" %} **Targets**\
\
The systems and services scanned by GuardWare DISCOVER. Targets can include endpoints, SMB file shares, and cloud-based services such as Exchange Online, SharePoint Online, Gmail, and Google Drive. {% endhint %} {% endcolumn %} {% endcolumns %}
### Hosting Methods
The Management Console can be hosted in one of two ways: **On-Premises** or **Cloud-hosted**. This choice determines where scan configuration, results, and administration take place, and it shapes which Scanning Agent deployment models are available to you.
#### On-Premises
The Management Console is installed on a device or virtual machine inside the organisation's own network. This is the typical choice for closed-off or high-security environments, such as banks and other regulated institutions, where infrastructure cannot extend outside the organisation's own network boundary.
On-Premises supports two Scanning Agent deployment models:
{% hint style="info" %} **Local Deployment**\
\
The Scanning Agent is installed on every device or file server, and each one scans itself. This requires the agent to be installed individually on each target. {% endhint %}
{% hint style="info" %} **Scanning Server Deployment**\
\
The Scanning Agent is installed on one or more dedicated devices or virtual machines, known as Scanning Servers. Each Scanning Server connects to devices that do not have the agent installed over SSH, SMB, or WinRM, and performs scans on them remotely. This removes the need to install an agent on every individual endpoint. {% endhint %}
#### Cloud-hosted
The Management Console is hosted in the GuardWare cloud, removing the need to provision and maintain a console server on-site. Only the Scanning Agent needs to be installed within the organisation's environment. Cloud-hosted supports three Scanning Agent deployment models:
{% hint style="info" %} **Scanning Server model**\
\
The Scanning Agent is installed on a single device within the organisation, acting as a Scanning Server. It connects to devices that do not have the agent installed over SSH, SMB, or WinRM, and performs scans on them remotely, reporting results back to the cloud-hosted console. {% endhint %}
{% hint style="info" %} **Local Deployment model**\
\
The Scanning Agent is installed on every device or file server, and each one scans itself and reports results directly to the cloud-hosted console. {% endhint %}
{% hint style="info" %} **Fully cloud-hosted model**\
\
Both the Management Console and the Scanning Agent are hosted on a dedicated server or virtual machine in the cloud. This single cloud instance remotely scans the organisation's devices over SSH, SMB, or WinRM, without requiring any on-premises infrastructure at all. {% endhint %}
#### M365 and cloud-native environments
Organisations operating primarily in Microsoft 365 or other cloud services can scan those targets directly, without deploying a Scanning Agent for them. Microsoft 365 credentials are configured directly in the Management Console, which then queries services such as Exchange Online and SharePoint Online through their APIs.
{% hint style="info" %} Since M365 environments are cloud-native, the Cloud-hosted console is typically the natural fit, though an On-Premises console can also connect to M365 the same way. A Scanning Agent is only needed if you also have on-site endpoints or file servers to scan. {% endhint %}
{% hint style="info" %} A Scanning Server can also scan its own local files. In that case, the scan is treated as a local scan rather than a remote one. {% endhint %}
### Deployment and Setup Flow
Deploying GuardWare DISCOVER involves choosing a hosting method for the Management Console, then choosing how the Scanning Agent will be installed.
{% stepper %} {% step %}
#### Choose a hosting method and install the Management Console
Decide whether the Management Console will be On-Premises or Cloud-hosted, based on your organisation's infrastructure and security requirements. For On-Premises, install the console on a dedicated Windows system. For Cloud-hosted, the console is provisioned for you in the GuardWare cloud. {% endstep %}
{% step %}
#### Deploy the Scanning Agent
Depending on the chosen architecture, this may involve installing the Scanning Agent on every endpoint for local scanning, or installing it on one or more dedicated hosts to act as Scanning Servers for remote scanning over SSH, SMB, or WinRM.
In every model, the Scanning Agent acts as the execution layer that carries out scan tasks assigned by the Management Console.\
[**Scanning Agent Deployment Guide→**](https://claude.ai/setup-and-deploy/install-discover-agent/install-discover-agent.md) {% endstep %}
{% step %}
#### Configure and Run Scans
This includes adding scan targets, configuring Microsoft 365 credentials where necessary, and assigning data ownership where applicable. These configurations define what will be scanned and under what context.
Scan jobs can then be created and executed from the Management Console. Results are returned and displayed within the interface, allowing you to review findings, investigate files for sensitive data, and initiate remediation actions.\
[**DISCOVER Quick Start Guide →**](https://claude.ai/discover/getting-started/discover-quick-start-guide.md) {% endstep %} {% endstepper %}
### Console Access and Operation
Familiarising administrators with the Management Console is essential, as all administrative and operational tasks are performed there, whether it is hosted on-premises or in the cloud. Functions are organised neatly, and related tools are grouped in the navigation menu for easy access.
Access to the console requires valid administrator credentials. After authentication, users must complete a second layer of verification using a time-based authenticator application. This ensures that access to sensitive scan data and system controls is properly secured.
Once logged in, the console provides a centralised view of all scan activity, including status, results, and historical reporting. From here, administrators can manage the full lifecycle of data discovery operations.
GuardWare DISCOVER is a cross-platform system designed to identify, classify, and manage sensitive data across enterprise environments. It operates across endpoints, file servers, email systems, and cloud services, helping organisations detect and reduce exposure of regulated and sensitive information including PCI, PII, PHI, as well as custom data types.
At its core, DISCOVER is built around a centralised model of control and distributed execution. This allows it to scale across diverse infrastructures while maintaining a single point of visibility and administration.
## System Architecture
The system is composed of three primary components that work together: the Management Console, the Scanning Server, and the Targets being scanned.
{% columns fullWidth="false" %}
{% column width="33.33333333333333%" %}
{% hint style="info" icon="1" %}
**Management Console**\
\
The central web application where scan jobs are scheduled, configurations are stored, and results are reviewed. It provides visibility into scan status, investigations, and remediation options.
{% endhint %}
{% endcolumn %}
{% column width="33.33333333333333%" %}
{% hint style="info" icon="2" %}
**Scanning Server**\
\
A dedicated host or virtual machine with the Scanning Agent installed. It receives scan and remediation tasks from the Management Console, executes them, and reports the results back.
{% endhint %}
{% endcolumn %}
{% column %}
{% hint style="info" icon="3" %}
**Targets**\
\
The systems and services scanned by GuardWare DISCOVER. Targets can include endpoints, SMB file shares, and cloud-based services such as Exchange Online, SharePoint Online, Gmail, and Google Drive.
{% endhint %}
{% endcolumn %}
{% endcolumns %}
## Scanning Agent Deployment Models
The Scanning Agent is installed on a machine to execute tasks received from the Management Console. It scans the targets and returns results and status to the Management Console.
DISCOVER supports two deployment models for the Scanning Agent, depending on the structure of the environment being scanned:
### Local Deployment
In a **Local deployment**, the Scanning Agent is installed directly on the target device, which scans its own local data. This requires the agent to be installed on each device individually.
### Scanning Server Deployment
The **Scanning Server deployment** introduces a centralised scanning model. In this setup, the Scanning Agent is installed on a dedicated server or virtual machine, which remotely scans multiple systems across the network. This is referred to as agentless scanning, as it removes the need for agent installation on each individual endpoint. This approach simplifies deployment in larger or more distributed environments.
{% hint style="info" %}
Although its primary role is remote scanning, a Scanning Server can also scan its own local files. In that case, the scan is treated as a local scan.
{% endhint %}
## Deployment and Setup Flow
Deploying GuardWare DISCOVER for scanning involves setting up the Management Console and then choosing how the Scanning Agent will be installed.
{% stepper %}
{% step %}
### Install the Management Console
The first step is installing the **Management Console** on a dedicated Windows system. This system becomes the central control point for all scanning activity, including configuration, scheduling, and reporting.
{% endstep %}
{% step %}
### Deploy the Scanning Agent
After the Management Console is operational, the next step is deploying the **Scanning Agent**. Depending on the chosen architecture, this may involve installing the Scanning Agent directly on endpoints for local scanning or deploying it on a dedicated host for remote (agentless) scanning.
In both cases, the Scanning Agent acts as the execution layer that carries out scan tasks assigned by the Management Console.\
[**Scanning Agent Deployment Guide→**](/setup-and-deploy/install-discover-agent/install-discover-agent.md)
{% endstep %}
{% step %}
### Configure and Run Scans
This includes adding scan targets, configuring Microsoft 365 credentials where necessary, and assigning data ownership where applicable. These configurations define what will be scanned and under what context.
Scan jobs can then be created and executed from the Management Console. Results are returned and displayed within the interface, allowing you to review findings, investigate files for sensitive data, and initiate remediation actions.\
[**DISCOVER Quick Start Guide →**](/discover/getting-started/discover-quick-start-guide.md)
{% endstep %}
{% endstepper %}
## Console Access and Operation
Familiarising administrators with the Management Console is essential, as all administrative and operational tasks are performed there. Functions are organised neatly, and related tools are grouped in the navigation menu for easy access.
Access to the console requires valid administrator credentials. After authentication, users must complete a second layer of verification using a time-based authenticator application. This ensures that access to sensitive scan data and system controls is properly secured.
Once logged in, the console provides a centralised view of all scan activity, including status, results, and historical reporting. From here, administrators can manage the full lifecycle of data discovery operations.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.guardware.com/discover/about/introduction-to-discover.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.