> For the complete documentation index, see [llms.txt](https://docs.guardware.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.guardware.com/discover/getting-started/discover-3-hour-training.md). # DISCOVER 3-hour training ## Overview This training module is designed to give users a practical introduction to DISCOVER. It covers: * Product architecture, scanning models, and key components * Microsoft 365 integration, target discovery, and Scanning Server setup * Data governance, data types, classifications, and scan configuration * Results review, investigation, remediation, and positioning with PROTECT and INSIGHT ### Duration * **Session 1** - 50 minutes * **Break** - 10 minutes * **Session 2** - 50 minutes * **Break** - 10 minutes * **Session 3** - 50 minutes ### Session 1 - 50 minutes #### Topics covered * DISCOVER overview * How to integrate with Microsoft 365 * How to set up a scanning server * How to perform local and remote scans * What a secure move location is * How to set up classifications * What data types and sub data types are available in the system * How to define new data types * How to define complex regular expressions * How to combine regex with other conditions * How to discover what to scan (targets) #### 1. Product overview and architecture - 5 minutes Cover the product at a high level first. **Cover** * What DISCOVER is * Where it fits in the data security workflow * How data moves from detection to action * The workflow: **Data types** → **Scan** → **Results** → **Remediation** * The main components: * **Management Console** * **Scanning Server** * **Target devices and services** * The two scanning models: * **Local scan** * Agent installed on the target device * The device scans itself * **Agentless scan** * Agent installed on a Scanning Server * Scans remote systems over: * WinRM * SSH * SMB #### 2. Server installation - 10 minutes (Optional) Run a live installation walkthrough. **Cover** * What the installation includes * The minimum prerequisites for setup * What trainees should expect after first sign-in **Demonstrate** * GuardWare Server installation * Initial setup * First access to the Management Console **Trainer focus** * Show the minimum steps required to get to a usable console * Point out any prerequisites that commonly block setup #### 3. Management Console introduction - 5 minutes Show the main navigation areas. **Cover** * Organisation settings * Setting up a secure location * Setting an investigation password * Integrating with Microsoft 365 * Devices * Data Governance * Resources **Demonstrate** * Moving through the main Console areas * Locating the settings used later in the session #### 4. Getting started - Agent/Scanning Server configuration - 10 minutes Walk through agent preparation for scanning. **Cover** * How local and agentless scanning differ **Demonstrate** * Agent configuration * Agent download * Agent installation * For **local scan**, install the downloaded agent on a target device * For **agentless/remote scan**, install the downloaded agent on a Windows host. The Windows host becomes the **Scanning Server** and scans multiple remote systems across the network * Complete the setup wizard * Confirm the Scanning Server appears as **Online** in the Console **Trainer focus** * Call out exception list for DISCOVER folders and executables * Show where to review agent status, assigned targets, and request logs **Key points** * A local scan runs on the target device itself * An agentless scan uses a Scanning Server to scan remote systems across the network #### 5. Data governance - 20 minutes Show how governance settings define what DISCOVER detects, classifies, and escalates. **Cover** * Built-in data types first * Credit cards * Passport numbers * PII * Financial information * Custom data types using: * **Sensitive Words** * **Regular Expressions** * **Filename Expressions** * Example inputs: * Sensitive words: `Confidential`, `Salary`, `Acquisition` * Regular expressions: employee IDs, customer numbers, passport formats * Filename expressions: `Confidential_*.pdf`, `Payroll_*.xlsx` * Subtypes and their value: * Better categorisation * Reduced false positives * Manual classifications such as: * Public * Internal * Confidential * Restricted * Purview synchronisation * Data owners and how they are used: * Data owners are assigned to data types * They are not necessarily device owners * They receive notifications when sensitive data is discovered * Example: * An HR manager receives an alert when employee-sensitive data is found outside approved locations **Demonstrate** * Reviewing built-in data types * Creating a custom data type with **Sensitive Words** * Creating a custom data type with **Regular Expressions** * Define complex regular expressions * Combine regex with other conditions * Creating a custom data type with **Filename Expressions** * Creating a manual classification * Showing where Purview-synchronised classifications appear * Assigning a data owner to a data type **Trainer focus** * Emphasise how better data type design improves scan quality * Show how subtypes help reduce false positives * Show how notifications reach the right business owner **Key points** * Existing Microsoft classifications can be synchronised into DISCOVER #### 6. Target discovery - 10 minutes Show both discovery paths. **Cover** * Device discovery for remote systems * Service discovery for cloud platforms * The prerequisites that make discovery succeed **Demonstrate** * Device discovery over WinRM * Device discovery over SSH * SMB file server discovery * SharePoint Online discovery * Exchange Online discovery * Gmail discovery * Google Drive discovery **Trainer focus** * Spend extra time on WinRM and SSH setup * Call out the firewall, routing, and credential issues that block discovery most often * Explain the minimum host-side setup required before discovery succeeds ### Break - 10 minutes ### Session 2 - 50 minutes #### Topics covered * How to configure scans * What is a one-time scan * What is an ongoing scan * Key considerations when conducting scans * How to run a classification scan * How to use **Scan and Classify** * Key considerations when running classification scans * How to review results * How to review scan progress and scan status * Scan performance considerations #### 7. Create a scan - 15 minutes Explain the two scan types, then configure a scan live. **Cover** * **One-Time Scan** for: * Quick validation * Testing * **Ongoing Scan** for: * Continuous monitoring * Scheduled execution * When to use each scan type **Demonstrate** * Selecting data types * Selecting targets * Archive scanning * OCR Options * Changed files only * Scheduling * Scan and Classify * Running the scan * Showing scan progress * Showing scan status * Showing where results appear **Trainer focus** * Explain when to use Scan and Classify * Show how classification is applied as part of the scan workflow * Explain why this is important for downstream monitoring and protection **Key points** * Multiple one-time scans can run * Only one ongoing scan can run at a time #### 8. Scan scope and file handling options - 10 minutes Show how to control scan coverage. **Cover** * How to control scan coverage * When a narrow scope is better than broad coverage **Demonstrate** * Scanning only selected folders and file types * Scanning all content except excluded folders and file types * Archive file handling * OCR for images * OCR for documents * Exchange date filtering * Auto-scan newly discovered devices for ongoing scans **Trainer focus** * Show when a narrow validation scan is better than broad coverage * Show how file and folder filters reduce scan time and false positives #### 9. Scan performance and scheduling considerations - 10 minutes Explain the operational impact of scan settings. **Cover** * OCR adds significant overhead for image-heavy PDFs * HTML, HTM, and Markdown files can take much longer than expected * Many small files can take longer than fewer large files * Ongoing scans should run outside business hours where possible * Avoid scan windows and termination settings affect scheduled coverage **Trainer focus** * Use a small OCR comparison example if possible * Explain why representative test scans matter before wider rollout #### 10. Dashboard - 5 minutes Start here so trainees can review discovered data at a higher level before drilling into individual findings. **Cover** * **Dashboard** for aggregated metrics across scans * **Summary Report** for findings from a specific scan job * Potential Sensitive Data * Potential Data by Target * Discovered vs Investigated vs Remediated Data **Demonstrate** * Dashboard review * Summary Report review * Scan-level filtering * High-level metrics and trend views #### 11. Results - 10 minutes **Cover** * How results are grouped across devices, SharePoint, and email **Demonstrate** * Findings review * Device results * SharePoint results * Email results **Trainer focus** * Show how to filter by scan, target, data type, and classification * Show how to move from high-level trends into file-level findings * Explain when to use Results instead of Dashboard ### Break - 10 minutes ### Session 3 — 50 minutes #### Topics covered * How to set up investigation prerequisites * How to create and use investigations * How to delete data * How to classify identified data * How to copy data to a secure location * How to move data * How to move SharePoint data to another SharePoint site * How to move email to a secure email account * How to review remediation history * How to review logs and agent activity #### 12. Investigation - 10 minutes Show how to inspect sensitive files in a controlled workflow. **Cover** * Why an investigation password is required **Demonstrate** * Creating an investigation password * Creating an investigation * Moving findings into the investigation * Reviewing files **Trainer focus** * Explain that previously downloaded files keep the password used at the time of download * Show why the secure location must be ready before investigation or move actions #### 13. Remediation - 15 minutes Show how to take action on findings. **Cover** * When to use **Move**, **Copy**, **Delete**, and **Classify** * Who should be notified after remediation **Demonstrate** * Setting up a secure location * **Move** - Move files to a secure location * **Copy** - Copy files to a controlled location * **Delete** - Delete approved files * **Classify** - Apply the appropriate classification action * Email Notifications * Notifying the data owner * Notifying the end user **Trainer focus** * Make **Classify** a required demo item * Explain when classification is the right remediation action instead of move or delete #### 14. Remediation history and operational review - 10 minutes **Cover** * How to review remediation history * How to review operational logs and agent activity * These log types: * Scan Logs * Target Discovery Logs * Investigation Logs * Remediation Logs * Service Logs **Demonstrate** * **Remediation** history * Status tracking * Previous comments * Remediated by * Remediated at * Request Logs from the agent **Trainer focus** * Show how to use logs to troubleshoot scan, connection, and remediation issues * Show where to confirm agent health and workload #### 15. Positioning PROTECT and INSIGHT - 10 minutes Position DISCOVER as the discovery layer in the wider platform workflow. **Cover** * DISCOVER identifies and remediates sensitive data * INSIGHT helps monitor sensitive data exposure and trends * PROTECT provides persistent encryption and protection **Key points** * Together, they support a discovery-to-protection workflow #### 16. Q\&A - 5 minutes Leave time for open discussion. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.guardware.com/discover/getting-started/discover-3-hour-training.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.