DISCOVER Training Guide
Learn how to deploy, configure, operate, and maintain DISCOVER with confidence.
Overview
This guide helps administrators learn how to operate DISCOVER confidently. It goes beyond first use and focuses on repeatable setup, sound scanning decisions, and safe handling of findings.
Use this guide if you need to understand:
how DISCOVER is structured
how to prepare targets and scanning servers
how to configure governance and scans correctly
how to review, investigate, and remediate findings
If you only need the fastest path to your first scan, use the DISCOVER Quick Start Guide.
Training outcomes
By the end of this guide, you should be able to:
explain how DISCOVER components work together
choose between local and agentless scanning
configure data types, classifications, and target discovery
run scans with the right scope and options
investigate and remediate findings safely
monitor scan activity and interpret results
Recommended audience
This guide is intended for:
security administrators
IT operations teams
compliance teams supporting data discovery workflows
Before you begin
Make sure you have:
access to the GuardWare Management Console
a deployed Scanning Agent or Scanning Server
administrator credentials for your target systems
Microsoft 365 administrator access if you plan to scan Exchange Online or SharePoint Online
For product background, start with Introduction to DISCOVER.
Understand the DISCOVER operating model
DISCOVER is built around three core components:
Management Console for configuration, scheduling, and review
Scanning Server for task execution
Targets such as endpoints, file shares, and cloud services
You can deploy scanning in two ways:
Local scanning installs the agent on the target device
Agentless scanning installs the agent on a separate Windows host that scans remote targets
Use local scanning when a device needs to scan its own files directly. Use agentless scanning when one host needs to scan many systems across the network.
Start here:
Prepare the environment
A stable deployment depends on correct server setup, network access, and endpoint preparation.
Work through these tasks first:
Install and validate the Management Console.
Deploy the Scanning Agent to a target device or dedicated Scanning Server.
Confirm the agent appears online.
Allow required network access between the console, scanning host, and targets.
Add DISCOVER folders and processes to your security allowlist.
For full installation details, use:
For most environments, agentless scanning gives broader coverage with less endpoint deployment effort.
Configure governance before scanning
DISCOVER becomes more useful when findings map to business meaning.
Before you scan at scale:
Create or sync classifications.
Create data types that reflect what you need to detect.
Assign each data type to the right classification.
Assign data owners where notifications are required.
This model drives how findings are labelled and who gets notified.
The key relationship is simple:
a data type belongs to a classification
one or more data owners can be assigned to a data type
a file inherits the highest classification from its matches
See the configuration flow in the DISCOVER Quick Start Guide.
Discover targets correctly
Target discovery defines what DISCOVER can scan.
Use Devices discovery for:
Windows endpoints over WinRM
non-Windows devices over SSH
file shares over SMB
Use Services discovery for:
Exchange Online
SharePoint Online
When creating discovery jobs:
Choose a clear job name.
Select the correct protocol or cloud connector.
Use credentials with the minimum access needed to reach the target.
Choose a scanning server in the right location.
Set retry and timeout values that fit your network.
Use Target Discovery for the full process.
If a device does not appear in results, check routing, firewall rules, protocol access, and credential format before changing the scan design.
Design scans with the right scope
A good scan design balances coverage, accuracy, and runtime.
DISCOVER supports two operating scan types:
One-Time Scan for testing, targeted checks, and validation
Ongoing Scan for scheduled monitoring and trend tracking
When building a scan, decide:
Which data types matter for this objective.
Which targets or services should be included.
Whether to enable archive scanning.
Whether OCR is necessary.
Whether to include all folders or narrow the scope.
Whether to include only new or changed files.
Use Scans to configure both scan types.
Review scan performance and operational impact
Scan performance varies by file type, file count, OCR use, and network conditions.
Watch for these common drivers:
OCR adds significant overhead for PDFs
large HTML and Markdown files take longer than expected
many small files can take longer than fewer large files
Use Scan Performance when planning schedules, especially for ongoing scans.
Best practices:
schedule heavier scans outside business hours
test OCR on representative samples first
exclude irrelevant folders and file types where possible
Review findings and prioritise action
After a scan completes, review findings in context.
Use:
Results for detailed finding review
Dashboard for trends and broader visibility
Summary Report for scan-specific analysis
Focus first on:
high-sensitivity classifications
high-volume targets
repeated findings across ongoing scans
data types that indicate regulated data exposure
Relevant pages:
Set up investigation safely
Before downloading flagged files, set up the secure handling workflow.
You must configure:
a Secure Location for copied or moved files
an Investigation Password for protected downloads
Then you can:
create an investigation
move selected findings into it
download protected ZIP files for review
Use these pages:
Store the investigation password securely. Previously downloaded files cannot be opened without it.
Remediate findings with intent
Remediation should follow validation, not guesswork.
DISCOVER supports these actions:
move
copy
delete
classify
send email to data owner
send email to device owner
Choose the action that matches the risk and your internal policy.
Examples:
use Classify when the file needs the right sensitivity label
use Move or Copy when a secure review path is needed
use Delete only when policy allows permanent removal
Use Remediation for the detailed workflow.
Monitor operations and improve continuously
Training is complete when the workflow becomes repeatable.
As part of normal operations:
review scan completion status regularly
monitor trends in the dashboard
review agent health and logs
refine scan scope based on performance and false positives
update data types and classifications as requirements change
Use these pages during steady-state operations:
Suggested training flow for new administrators
Follow this sequence for onboarding:
Read Introduction to DISCOVER.
Complete the DISCOVER Quick Start Guide.
Build one test discovery job and one test scan.
Review findings in the dashboard and results views.
Create one investigation and one controlled remediation exercise.
Move to scheduled scanning only after the test workflow is stable.
What to practice during training
Use a non-production or low-risk scope first.
Recommended exercises:
discover a small device range or one cloud service scope
run one one-time scan with a limited set of data types
compare results with OCR on and off for a small sample
send selected findings into an investigation
test one safe remediation action such as classify or copy
Next steps
After training, keep these pages close:
With this workflow in place, you can move from first use to reliable day-to-day DISCOVER operations.
Last updated