DISCOVER Quick Start Guide

Overview

GuardWare DISCOVER is a cross-platform data discovery, investigation, and remediation system that locates, analyses, and manages sensitive data across endpoint devices, file servers, email systems, and cloud storage.

DISCOVER follows a simple operating flow:

• Scan finds sensitive data across selected targets.
• Investigation lets you flag files of interest and securely download and review them.
• Remediation lets you move, delete, copy, and classify the sensitive data detected across scanned systems and send emails regarding the results to end users or data owners.

See Introduction to DISCOVER for the platform overview.

DISCOVER has three core components:

• Management Console: The central web application. Stores configuration and results. Schedules scan jobs. Displays scan status, reports, investigations, and remediation options.
• Scanning Server: A Windows service where the scanning agent is installed. It performs scans on target devices and shows the scan results in the Management Console.
• Targets: The systems being scanned. Can include endpoints, SMB file shares, Exchange Online, and SharePoint Online.

Architecture: Local vs Agentless scanning

1. Local scan: A local scan is performed when the agent is installed on a target device, and the device scans itself for sensitive data.
2. Agentless scan (Remote scan): An agentless scan is performed using a scanning server where the agent is installed. The scanning server remotely connects to target devices that do not have the agent installed using protocols such as WinRM, SSH, or SMB (for file servers) and performs the scan on those devices.

We recommend using remote scanning for centralised coverage across devices and services.

Classifications, data types, and data owners

DISCOVER uses a simple governance model:

• Classifications define sensitivity levels.
• Data Types define what DISCOVER detects.
• Data Owners define who is notified.

The relationship is direct:

• A data type belongs to a classification.
• One or more data owners can be assigned to a data type.
• A file inherits the highest sensitivity classification from matched data types.

See DATA GOVERNANCE for the full governance model.

What this guide covers

• Console access
• Scanning Server configuration
• Connecting Microsoft 365
• Target discovery, scanning, and review
• Investigation and remediation

This guide introduces the essential steps for quickly initiating scan jobs and getting visibility into your sensitive data landscape.

Before getting started, make sure you have installed the GuardWare Server and can access the GuardWare Management Console.

1

Log in to the Console

1. Open the GuardWare Management Console URL.
2. Sign in with your admin or organisation account.
3. Complete 2FA, EULA acceptance, and password setup if prompted.

If Microsoft sign-in is enabled, you can also use your Microsoft account.

2

Whitelist DISCOVER

Add the following directories and executables to your security solution's exclusion or trusted applications list.

1. C:\Program Files\Guardware\GuardWare DISCOVER.
2. C:\Program Files\Guardware\GuardWare DISCOVER\MIPLabelHandler.
3. GuardWareDiscoverAgent.exe
4. GWActiveMon.exe

3

Download the Agent

1. Navigate to ORGANISATION > Agent Download > DISCOVER Agent.
2. Set the Location and click Update.
3. Click Submit. The Download link only appears after the configuration is complete.

Once the installation settings are complete, the Download Installer link becomes available. Click it to download the agent with the configured settings.

4

Configure the Scanning Server

1. For local scan, install the downloaded agent on a target device.
2. For agentless/remote scan, install the downloaded agent on a Windows host. The Windows host becomes the Scanning Server and scans multiple remote systems across the network.
3. Complete the setup wizard.
4. Confirm the Scanning Server appears as Online in the Console.

For remote scan, each target device must be configured to accept connections from the Scanning Server host using the appropriate protocol. GuardWare provides PowerShell scripts that enable the required services, set permissions, and configure firewall rules.

For Microsoft 365 targets, no script is required on target devices. The Scanning Server host needs outbound HTTPS access and valid Microsoft Entra ID credentials.

See Scanning Server Deployment Guide for remote access configuration.

5

Connect Microsoft 365

Connect your Microsoft 365 environment to enable scanning of Exchange Online and SharePoint Online. Ensure you have the Global Administrator account's credentials ready.

1. Navigate to ORGANISATION > Integrations.
2. Click Connect Microsoft 365.
3. Sign in with a Global Administrator account.
4. Review the requested permissions.
5. Select Consent on behalf of your organisation.
6. Click Accept.

6

Define classifications and data types

Set up classifications and data types before you run scans. This makes results easier to review and act on.

1. Navigate to DATA GOVERNANCE > Data Classification.
2. Create classifications manually with +Add Classification, or click Sync to import published Microsoft Purview Information Protection sensitivity labels.
3. Run Sync again after labels are added or changed in Microsoft Purview.
4. Go to DATA GOVERNANCE > Data Type.
5. Click +Data Type and enter the data type name and description.
6. Choose the identifier type:

   • Sensitive Words
   • Regular Expressions
   • Filename Expressions
7. Assign a classification and data owner.
8. Click Save.

See DATA GOVERNANCE for more details.

7

Discover target devices and services

Before you can scan, DISCOVER must know what to scan. Targets are the systems and services DISCOVER scans to detect sensitive data. Properly defining targets ensures scans reach the correct data sources and provide comprehensive visibility across your environment.

Start with your highest-priority systems that are most likely to contain sensitive data and expand gradually based on your requirements.

Devices

Device targets include workstations, laptops, and file servers where sensitive data may reside.

1. Go to DISCOVER > Target Discovery > Devices and click +New Target Discovery.

   
2. Enter a Job Name for the discovery job, and specify the Target IP range to define the network segment in which DISCOVER should search for devices.
3. Set the Location to filter the list of scanning servers by their assigned location.
4. Select the appropriate Protocol (WinRM, SSH, or FILE SERVER) to connect to the devices and provide Authentication credentials.

   • SSH for non-Windows devices.
   • WinRM for Windows devices.
   • File Server (SMB) for shared storage and file servers.
5. Set the Connection Attempt Interval to define how frequently DISCOVER will try to connect to a target.
6. Set Give-up Trying After to specify the maximum duration DISCOVER will continue attempting the connection before abandoning it.
7. Click Save.

Services

Cloud services extend DISCOVER's reach to data stored in external platforms, ensuring complete coverage of your digital assets regardless of location.

1. Go to DISCOVER > Target Discovery > Services and click +New Target Discovery.

1. Enter the Discovery Job name, then select the Cloud Connector for the service type (Microsoft Exchange or SharePoint).
2. Specify the Organisation (for SharePoint) and provide the Client ID and Tenant ID for authentication.
3. Set the Location to filter the list of scanning servers by their assigned location.
4. Select either Client Exchange Secret or Certificate as an authentication method.
5. Set the Connection Attempt Interval to define how frequently DISCOVER will try to connect to a target.
6. Set Give-up Trying After to specify the maximum duration DISCOVER will continue attempting the connection before abandoning it.
7. Click Save.

Discovered devices and services then appear in Devices/Services Found and can be selected in scans.

After a target discovery job completes, you can use Rediscover from DISCOVER > Target Discovery to run that same job again. Rediscover uses the same settings and target discovery parameters as the original job. You cannot change them during the rerun. Use it when devices in the discovery range were temporarily unavailable or unreachable.

For more details, see Target Discovery.

8

Create and run a scan

After target devices are found, create your first scan. During a scan, DISCOVER examines the selected devices and services by checking the specified directories (or all directories, if configured) and the specified file types for sensitive data.

It then searches within those files, identifying and reporting any sensitive data it detects. You can run a One-Time Scan for testing or targeted scans, or an Ongoing Scan for routine monitoring.

Configure and Run a One-Time Scan

A One-Time Scan checks new or changed files on the selected targets against your configured data types and classifications. Use it to validate a new rule, perform a targeted check, or test new scan configurations.

1. Navigate to DISCOVER > Scans and click +New Scan.

1. Select One-Time Scan and click Proceed.

1. Enter a Scan Name and give a Description (optional), then click Next.
2. Select the data types you want to search for and click Next.
3. Select the targets and services to scan, then click Next.
4. Configure the File Handling Options, specify the files and folders you want to include or exclude from the scan, and then click Next.
5. Review the scan configurations and click Save Scan. The scan will begin automatically.

Configure and Run an Ongoing Scan

During execution, track progress in DISCOVER > Scans.

When the scan completes, open View Result or go to DISCOVER > Results.

9

Check results

From DISCOVER > Results, you can filter findings and move selected items into an investigation. After a scan completes, you can view details such as what sensitive data was found, which device or service it was found on, how many instances were detected, and any remediation actions that have been applied.

By default, you'll see results from all completed scans. Use the filter options at the top of the page to narrow results by scan job, date range, data type, classification, or target name.

10

Analyse discovered data

Use the dashboard for trends and the results view for details.

1. Go to DISCOVER > Dashboard > Dashboard for high-level metrics.
2. Review widgets such as Potential Sensitive Data, Potential Data by Target, and remediation status.
3. Go to DISCOVER > Dashboard > Summary Report to review files and targets by data type for a specific scan.
4. Go to DISCOVER > Results to inspect individual findings and refine filters by scan, target, data type, and classification.

Use this review to confirm risk, prioritise targets, and decide what needs investigation or remediation first.

See DISCOVER Dashboard for more details.

11

Classify discovered information

DISCOVER classifies files based on the matched data types. The highest matched classification is applied to the result.

1. Confirm that the relevant data types already have classifications assigned.
2. Review findings in DISCOVER > Results.
3. If a file needs a different label, use Remediate > Classify.
4. If you need to update the default mapping, go to DATA GOVERNANCE > Data Type and assign the correct classification to the data type.

This keeps discovered information aligned with your handling policy.

12

Create an investigation

Use the Investigation feature when you need to review discovered files more closely.

Before you investigate files, configure the secure location and investigation password first.

Set up a secure location and an investigation password

When DISCOVER identifies sensitive files during a scan, you may need to investigate or remediate them. A secure location is a designated storage area where these files are copied or moved, keeping them in a controlled environment separate from their original location.

Investigation password is the password you need to access the files downloaded using DISCOVER's Investigate function. Set the investigation password before conducting any investigations, and store it securely. If it is lost, previously downloaded files cannot be opened.

Set them in ORGANISATION > Set Up Secure Location.

See Secure Location and Investigation Password for more details.

Create a new investigation

1. Navigate to DISCOVER > Investigation.
2. Click + New Investigation.
3. Enter a name and a short purpose.
4. Click Create.

Move items into the investigation

1. Navigate to DISCOVER > Results.
2. Select one or more findings.
3. Click Investigate.
4. Select an existing investigation from the drop-down or create a new one by entering a new name.
5. Add an optional comment, and click Investigate. Investigation results are made available as password-protected ZIP downloads.
6. Click the download icon to download the file. The files inside the ZIP are password-protected. Use the password you set up while setting up the secure location.

See Investigation for more details.

13

Remediate sensitive information

Use Remediate to reduce risk after you confirm a finding. You can move, copy, delete, classify, or notify the right owner.

1. Go to DISCOVER > Results > Remediate or DISCOVER > Investigation > Remediate.
2. Select one or more files and click Remediate.
3. Choose a remediation action from the drop-down.

Action	Function
Move	Relocates the file to a secure location.
Copy	Creates a copy of the file to a secure or alternate location.
Delete	Permanently removes the file.
Classify	Classify file according to selected classification.
Send Email to Data Owner	Notifies the assigned data owner with an email.
Send Email to Device Owner	Notifies the file owner or user who has the device in their possession.

1. Add a comment (optional) to provide context or notes for the task.
2. Click Remediate to execute the selected action.

Use DISCOVER > Remediation to track what action was taken, by whom, and when.

See Remediation for more details.

With these steps complete, DISCOVER is ready to scan your selected targets and help you identify, investigate, and remediate sensitive data across your organisation.