> For the complete documentation index, see [llms.txt](https://docs.guardware.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.guardware.com/discover/scan/scans.md). # Scans {% embed url="" %} The Scans section is where you configure and run scans against discovered devices and services. DISCOVER offers two scan types: * [**One Time Scan**](#one-time-scan) runs a single, non-recurring scan on selected devices, services, and data types. * [**Ongoing Scan**](#ongoing-scan) runs repeatedly on a defined schedule, continuously monitoring selected devices and services. The installed scanning agent's location determines how One Time and Ongoing scans run.

Specifics	Local Scanning	Agentless Scanning
How it works	The agent is installed on the target device itself	Agent is installed on a separate host or a virtual machine.
What it scans	The device's own local files	Other devices, file shares, or cloud services across the network
Best for	Single device coverage	Scanning multiple targets from one central host (Scanning Server).

### One Time Scan Create and run a One Time Scan to investigate a specific device or service, test new data type configurations, perform an ad-hoc compliance check, or scan a newly discovered device before adding it to ongoing monitoring. {% stepper %} {% step %} #### Start the scan 1. Navigate to **DISCOVER** > **Scans** and click **+New Scan**.

2. Select **One Time Scan** and click **Proceed**.

3. Enter a **Scan Name** that clearly identifies the purpose of the scan (e.g., *Finance SharePoint - Credit Card Check*). 4. Add an optional **Description** for context and click **Next**.

{% endstep %} {% step %} #### Select data types 1. From the list, check the boxes next to the data types you want to scan for.

2. Use the search box and **Filter** to quickly locate specific data types. 3. Click **Next** after selecting the desired data types. {% endstep %} {% step %} #### Select devices and services 1. Select the devices and services to scan. You can include multiple device or service types in the same scan job (for example, devices and Exchange mailboxes together), each spread across its own tab.

Target type	Displays
Exchange	Displays all discovered Exchange Online mailboxes.
Devices	Displays all discovered devices (workstations, laptops, file servers, network storage).
SharePoint	Displays all discovered SharePoint Online sites and document libraries.
Gmail	Displays all discovered Gmail mailboxes.
Google Drive	Displays all discovered Google Drive hosts and document libraries.

2. After selecting the desired targets, click **Next**.

{% endstep %} {% step %} #### Configure file handling options Configure how DISCOVER processes archives, images, documents, and classification labels during a scan. * **Archive File Handling:** Enable to process compressed files (ZIP, RAR, 7z, etc.). When enabled, DISCOVER extracts and scans the contents of archive files. When disabled, archive files are skipped.

* **File date filter:** Limit scanning to files matching a specific date attribute and condition. For example, before decommissioning an old file server, set Attribute to **Last accessed date**, Condition to **Older than**, and the date to two years back, to catch every file nobody has touched since and confirm nothing important gets lost before deletion.

\ Selecting **Between** opens a second date field for a start and end date. All other conditions use a single date field.

Field	Options
Date Attributes	Modification date, Creation date, Last accessed date
Conditions	Older than, Newer than, Equal to, Between

* **Fetch MIP Sensitivity labels:** Enable to extract the MIP Sensitivity labels from files during scanning.

* **OCR for Images:** Enable to extract and scan text from image files (JPG, PNG, GIF). Enable if sensitive data may exist in screenshots or photographed documents.

* **OCR for Documents:** Enable to extract text from PDFs, TIFF files, and other supported document formats.

* **Scan and Classify:** Enable to automatically apply a classification label to each file based on the most sensitive data detected during a scan.

* **Overwrite Existing Classifications:** * Select **Overwrite** to replace the existing file classification label(s). * Select **Do Not Overwrite** to keep the existing label(s) unchanged. * **Classify Method:** * Select **Classify Using Data Type** to apply the label mapped to the matched data type. * Select **Classify Using** to choose whether custom labels or Microsoft Purview-synced labels are applied to all scanned files, regardless of their sensitivity. * **Enable New Files Since Last Scan:** Enable this to scan only files that have been created or modified since the last time this target was scanned. This significantly speeds up subsequent scans by skipping unchanged files. * **Select Exchange Date:** For Exchange scans, specify a start date to scan only emails received from that date forward. Set this to a reasonable timeframe (e.g., the past 90 days) unless historical email coverage is required. {% endstep %} {% step %} #### Filter directories and file types This setting allows you to include or exclude specific folders and file types from the scan. If you skip this configuration, DISCOVER **will scan all folders and file types** in every selected target for sensitive data. You have multiple options for controlling which folders and file types are scanned: #### Scan only the selected folders and file types Limit the scan to specific locations and file formats. Only what you explicitly select is scanned. Use this when you already know where sensitive data is likely to exist and want to focus the scan there instead of scanning everything.

* **Include System Folders (Toggle):** Enable to include Windows system folders (`C:\Windows`, `C:\Program Files`). This is generally not recommended unless you need to scan system folders. * **Custom Folder Paths:** Click **+Add** to include folders to scan. Enter the full path (e.g., `C:\Users\Public\Documents`, `\\fileserver\HR\Payroll`). Add multiple paths as needed. Only these folders are scanned. * **Include All File Types (Toggle):** Enable to scan all supported formats (documents, spreadsheets, presentations, images, archives, emails). Disable it to limit scanning to specific extensions only. * **Include Custom File Types:** Click **+Add** to specify extensions to scan uncommon or proprietary file extensions not in DISCOVER's file type list. Only files having these extensions will be scanned. #### Scan all content except the selected folders and file types Scan everything except selected folders or file types. Use this when you want broad coverage while skipping known irrelevant areas, such as system folders, logs, or temporary folders.

* **Exclude System Folders (Toggle):** Enable to skip all Windows system folders. This is recommended for most scans, as system folders rarely contain user-generated sensitive data. * **Exclude Custom Folder Path:** Click **+Add** to specify folders to exclude. Enter the full path (e.g., `C:\Windows\Temp`, `\\fileserver\Backups`, `D:\Logs`). These folders are skipped during the scan. * **Exclude All File Types (Toggle):** Enable to skip file content scanning entirely and examine only file metadata, such as filenames and paths. This is rarely used and typically needed only for filename-based data types. * **Exclude Custom File Types:** Click **+Add** to specify extensions to exclude uncommon or proprietary extensions you don't want scanned (e.g., `.backup`, `.cache`).\ Click **Next** to proceed. {% endstep %} {% step %} ### Review and save the scan Review the scan configuration summary and click **Save Scan**. The scan initiates automatically and appears in the Scans list with a status indicator. Once the scan completes, click **View Result** to see the findings. {% endstep %} {% endstepper %} ### Ongoing Scan Use ongoing scans for continuous monitoring required by regulations or policies. Ongoing scans establish a baseline and track sensitive-data exposure. They also monitor devices and services for regular security reporting. {% stepper %} {% step %} ### Start the scan 1. Navigate to **DISCOVER** > **Scans** and click **+New Scan**. 2. Select **Ongoing Scan** and click **Proceed**.

3. Select data types and click **Next**.

{% endstep %} {% step %} ### Select devices and services 1. Select all devices and services you want to monitor continuously and click **Next**. {% endstep %} {% step %}

{% endstep %} {% step %} ### Configure file handling options 5. Configure file handling options following the same process as a One Time Scan, including one additional option: 1. **OCR for Documents:** When enabled, you can also configure classification behavior. 2. **Auto Scan Newly Discovered Device:** Enable to automatically include devices and services discovered after the scan is created. On each scheduled run, any newly discovered targets are added to the scan automatically. 3. **Enable New Files Since Last Scan:** Enable this to scan only files that have been created or modified since the last time this target was scanned. This significantly speeds up subsequent scans by skipping unchanged files. 4. **Scan and Classify:** Enable to automatically apply a classification label to each file based on the most sensitive data detected. 1. **Overwrite Existing Classifications:** Select **Overwrite** to replace an existing label. Select **Do Not Overwrite** to keep the existing label unchanged. 2. **Classify Method:** Select **Classify Using Data Type** to apply the label mapped to the matched data type. Or select a custom label or a Microsoft Purview-synced label to apply that label instead. {% endstep %} {% step %}

{% endstep %} {% step %} ### Filter directories and file types 6. **Filter directories and file types** allows you to include or exclude specific folders and file types from the scan. If you skip this configuration, DISCOVER **will scan all folders and file types** for sensitive data. You have multiple options for controlling which folders and file types are scanned: 1. **Scan Only the Selected Folders and File Types**\ Limit the scan to specific locations and file formats. Only what you explicitly select will be scanned. Use this when you know exactly where sensitive data exists and want to focus only on those locations.

1. **Include System Folders (Toggle):** Enable to include Windows system folders (`C:\Windows`, `C:\Program Files`). This is generally not recommended unless you need to scan system folders. 1. **Selected Folder Paths:** Click **+Add** to add folders to scan. Enter the full path (e.g., `C:\Users\Public\Documents`, `\\fileserver\HR\Payroll`). Add multiple paths as needed. Only these folders are scanned. 1. **Include All File Types (Toggle):** Enable to scan all supported formats (documents, spreadsheets, presentations, images, archives, emails). Disable it to limit scanning to specific extensions only. 1. **Include Custom File Types:** Click **+Add** to specify file type extensions to scan uncommon, proprietary, or file extensions not in DISCOVER's standard list. Only files matching these extensions will be scanned. 2. **Scan All Content Except the Selected Folders and File Types**\ Scan comprehensively while excluding specific folders or file types. Everything is scanned except what you explicitly exclude. Use this when you want broad coverage while skipping known irrelevant areas, such as system folders, logs, or temporary folders.

1. **Exclude System Folders (Toggle):** Enable to skip all Windows system folders. This is recommended for most scans, as system folders rarely contain user-generated sensitive data. 2. **Exclude Custom Folder Path:** Click **+Add** to specify folders to exclude. Enter the full path (e.g., `C:\Windows\Temp`, `\\fileserver\Backups`, `D:\Logs`). These folders are skipped during the scan. 3. **Exclude All File Types (Toggle):** Enable to skip file content scanning entirely and examine only file metadata, such as filenames and paths. This is rarely used and typically needed only for filename-based data types. 4. **Exclude Custom File Types:** Click **+Add** to specify extensions to exclude uncommon or proprietary extensions you don't want scanned (e.g., `.backup`, `.cache`).\ Click **Next** to proceed. {% endstep %} {% step %} ### Set the schedule

7. Set a Schedule to define when and how often the scan runs. 1. In the **Repeat Schedule Every** field, enter how frequently the scan should run. 1. **Select an interval:** Select the rate at which the scans repeat. 2. **Select a time:** Select the time at which the scans start.\ Example: Selecting **2** Months at **10:00** repeats the ongoing scan every 2 months at 10:00 AM. 2. Choose the **Scan Start From** date 1. **Specific Date:** Select a calendar date when the first scan should run. The scan will start on this date and then repeat according to the interval you set. 2. **Day of the Week:** Select a specific day (Monday, Tuesday, etc.) when scans should run. This is useful for scheduling scans during low-activity periods (e.g., every Sunday). 3. Ongoing scans can be resource-intensive (high CPU usage, network traffic, disk I/O); it's best to schedule them during off-hours when they won't impact user productivity. Use the **Avoid Scans** on option to specify when scans should NOT run, even if they're scheduled. 1. Click **+Avoid Time** to add a restriction. Select the day(s) of the week when scans should be avoided. Select the time range to avoid (e.g., 8:00 AM to 6:00 PM for business hours). You can add multiple avoid time windows to accommodate different schedules. 8. At the bottom of the Scheduling step, you'll find the **Terminate Current Scan** toggle. 1. Enable this option to stop any scan that is currently running when the newly configured ongoing scan starts. 2. Leave this option disabled if you want the current scan to finish first. 3. If the current scan runs past the scheduled start time of the new scan, the new scan will not run for that occurrence. It will wait until the next scheduled slot, whether that is the following week or month. 4. This can create a gap in scheduled coverage, so keep this in mind when setting scan times. 9. Click **Next** to continue. {% endstep %} {% step %} ### Review and save the scan 10. Once the schedule is configured, review the configuration summary and click **Save Scan**. The scan initiates automatically and appears in the **Scans** list. {% endstep %} {% endstepper %}

View Scan Results

After the scan completes, click **View Result** to see the findings. 1. Navigate to **DISCOVER** > **Scans**.

2. Locate the completed scan and click **View Result**. 3. This opens the Results page filtered to show only findings from this specific scan (see the Results section below for detailed information on reviewing scan findings).

View Scan Details

1. Navigate to **DISCOVER** > **Scans**. 2. Locate the scan and click **View** .

3. This displays the complete scan configuration.

Delete a Scan

1. Navigate to **DISCOVER** > **Scans**. 2. Locate the scan you want to remove and click **Delete** .

3. A confirmation prompt will appear. Click **Delete** to confirm.

Pause a Scan

1. Navigate to **DISCOVER** > **Scans**. 2. Locate the running scan and click **Pause** .

3. The scan immediately pauses and stops processing targets. Targets that have already been scanned retain their results. Targets not yet scanned remain in the queue.

Resume a Scan

1. Navigate to **DISCOVER** > **Scans**. 2. Locate the paused scan and click **Resume** .

3. The scan resumes from where it was paused, continuing to process remaining targets in the queue.

Terminate a Scan

1. Navigate to **DISCOVER** > **Scans**. 2. Locate the running scan and click **Terminate** .

3. A confirmation prompt will appear. Click **Terminate** to end the scan immediately.

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.guardware.com/discover/scan/scans.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.