Scans

The Scans section is where you configure and run scans against discovered targets. DISCOVER offers two scan options:

• One-Time Scan runs a single, non-recurring scan on selected targets and data types.
• Ongoing Scan runs repeatedly on a defined schedule, continuously monitoring selected targets.

The location of the installed scanning agent determines how scans run for both One-Time and Ongoing scan types.

	Local Scanning	Agentless Scanning
How it works	The agent is installed on the target device itself	Agent is installed on a separate host or VM Scanning Server.
What it scans	The device's own local files	Other devices, file shares, or cloud services across the network
Best for	Single device coverage	Scanning multiple targets from one central host

One-Time Scan

Create and run a one-time scan to investigate a specific target, test new data type configurations, perform an ad-hoc compliance check, or scan a newly discovered device before adding it to ongoing monitoring.

1. Navigate to DISCOVER > Scans and click +New Scan.
2. Select One Time Scan and click Proceed.
3. Enter a Scan Name that clearly identifies the purpose of the scan (e.g., Finance SharePoint - Credit Card Check). Add an optional Description for additional context and click Next.

   
4. From the data types list, check the boxes next to the data types you want to scan for and click Next. Use the search box to locate specific types quickly.

   
5. Select Targets / Services. You'll see three tabs representing different target types:

   1. Devices: Displays all discovered devices (workstations, laptops, file servers, network storage).
   2. Exchange: Displays all discovered Exchange Online mailboxes.
   3. SharePoint: Displays all discovered SharePoint Online sites and document libraries.

      

You can select targets across multiple tabs (e.g., scan both devices and SharePoint sites in the same scan job). Click Next after selecting all targets.

1. Configure File Handling Options:

   1. Archive File Handling: Enable to process compressed files (ZIP, RAR, 7z, etc.). When enabled, DISCOVER extracts and scans the contents of archive files. When disabled, archive files are skipped.
   2. OCR for Images: Enable to extract and scan text from image files (JPG, PNG, GIF). Enable if sensitive data may exist in screenshots or photographed documents.
   3. OCR for Documents: Enable to extract text from PDFs, TIFF files, and other supported document formats.
   4. Scan and Classify: Enable to automatically apply a classification label to each file based on the most sensitive data detected.

      1. Overwrite Existing Classifications: Select Overwrite to replace an existing label. Select Do Not Overwrite to keep the existing label unchanged.
      2. Classify Method: Select Classify Using Data Type to apply the label mapped to the matched data type. Or select a custom label or a Microsoft Purview-synced label to apply that label instead.
   5. Enable New Files Since Last Scan: Enable this to scan only files that have been created or modified since the last time this target was scanned. This significantly speeds up subsequent scans by skipping unchanged files.
   6. Select Exchange Date: For Exchange scans, specify a start date to scan only emails received from that date forward. Set this to a reasonable timeframe (e.g., the past 90 days) unless historical email coverage is required.

      
2. Filter Directories and Files Types allows you to include or exclude specific folders and file types from the scan. If you skip this configuration, DISCOVER will scan all directories and file types for sensitive data. You have multiple options for controlling which directories and file types are scanned:

   1. Scan Only the Selected Folders and File Types Limit the scan to specified locations and file formats. Only what you explicitly select will be scanned. Use this when you know exactly where sensitive data exists and want to focus only on those locations.

      

      1. Include System Folders (Toggle): Enable to include Windows system directories (C:\Windows, C:\Program Files). Generally not recommended unless you have a specific reason to scan system folders.
      2. Selected Folder Paths: Click +Add to add directories to scan. Enter the full path (e.g., C:\Users\Public\Documents, \\fileserver\HR\Payroll). Add multiple paths as needed—only these directories will be scanned.\
      3. Include All File Types (Toggle): Enable to scan all supported formats (documents, spreadsheets, presentations, images, archives, emails). Disable it to limit scanning to specific extensions only.
      4. Include Custom File Types: Click +Add to specify extensions to scan uncommon or proprietary file extensions not in DISCOVER's standard list. Only files matching these extensions will be scanned.
   2. Scan All Content Except the Selected Folders and File Types Scan everything except selected directories or file types. Use this when you want broad coverage while skipping known irrelevant areas like system folders, logs, or temporary directories.

      

      1. Exclude System Folders (Toggle): Enable to skip all Windows system directories. Recommended for most scans, as system folders rarely contain user-generated sensitive data.
      2. Exclude Custom Folder Path: Click +Add to specify directories to exclude. Enter the full path (e.g., C:\Windows\Temp, \\fileserver\Backups, D:\Logs). These directories will be skipped during the scan.
      3. Exclude All File Types (Toggle): Enable to skip file content scanning entirely and only examine file metadata (filenames, paths). Rarely used—typically only for filename-based data types.
      4. Exclude Custom File Types: Click +Add to specify extensions to exclude uncommon or proprietary extensions you don't want scanned (e.g., .backup, .cache). Click Next to proceed.
3. Review the scan configuration summary and click Save Scan. The scan initiates automatically and appears in the Scans list with a status indicator.

Once the scan completes, click View Result to see the findings.

Ongoing Scan

Use ongoing scans for continuous monitoring required by regulations or policies, to establish a baseline and track trends in sensitive data exposure across your environment, to monitor all devices and services without manual intervention, or to provide regular reporting on data security status.

1. Navigate to DISCOVER > Scans and click +New Scan.
2. Select Ongoing Scan and click Proceed.
3. Select data types and click Next.

1. Select all devices and services you want to monitor continuously and click Next.

1. Configure file handling options following the same process as a one-time scan, with one additional option:

   1. OCR for Documents: When enabled, you can also configure classification behavior.
   2. Auto Scan Newly Discovered Device: Enable to automatically include devices and services discovered after the scan is created. On each scheduled run, any newly discovered targets are added to the scan automatically.
   3. Enable New Files Since Last Scan: Enable this to scan only files that have been created or modified since the last time this target was scanned. This significantly speeds up subsequent scans by skipping unchanged files.
   4. Scan and Classify: Enable to automatically apply a classification label to each file based on the most sensitive data detected.

      1. Overwrite Existing Classifications: Select Overwrite to replace an existing label. Select Do Not Overwrite to keep the existing label unchanged.
      2. Classify Method: Select Classify Using Data Type to apply the label mapped to the matched data type. Or select a custom label or a Microsoft Purview-synced label to apply that label instead.

1. Filter Directories and Files Types allows you to include or exclude specific folders and file types from the scan. If you skip this configuration, DISCOVER will scan all directories and file types for sensitive data. You have multiple options for controlling which directories and file types are scanned:

   1. Scan Only the Selected Folders and File Types Limit the scan to specific locations and file formats. Only what you explicitly select will be scanned. Use this when you know exactly where sensitive data exists and want to focus only on those locations.

      

      1. Include System Folders (Toggle): Enable to include Windows system directories (C:\Windows, C:\Program Files). Generally not recommended unless you have a specific reason to scan system folders.

         1. Selected Folder Paths: Click +Add to add directories to scan. Enter the full path (e.g., C:\Users\Public\Documents, \\fileserver\HR\Payroll). Add multiple paths as needed—only these directories will be scanned.

            1. Include All File Types (Toggle): Enable to scan all supported formats (documents, spreadsheets, presentations, images, archives, emails). Disable it to limit scanning to specific extensions only.

               1. Include Custom File Types: Click +Add to specify file type extensions to scan uncommon, proprietary, or file extensions not in DISCOVER's standard list. Only files matching these extensions will be scanned.
               2. Scan All Content Except the Selected Folders and File Types Scan comprehensively while excluding specific areas or file types. Everything is scanned except what you explicitly exclude. Use this when you want broad coverage while skipping known irrelevant areas like system folders, logs, or temporary directories.

                  

                  1. Exclude System Folders (Toggle): Enable to skip all Windows system directories. Recommended for most scans, as system folders rarely contain user-generated sensitive data.
                  2. Exclude Custom Folder Path: Click +Add to specify directories to exclude. Enter the full path (e.g., C:\Windows\Temp, \\fileserver\Backups, D:\Logs). These directories will be skipped during the scan.
                  3. Exclude All File Types (Toggle): Enable to skip file content scanning entirely and only examine file metadata (filenames, paths). Typically, only for filename-based data types.
                  4. Exclude Custom File Types: Click +Add to specify extensions to exclude uncommon or proprietary extensions you don't want scanned (e.g., .backup, .cache). Click Next to proceed.
2. Set a Schedule to define when and how often the scan runs.

   1. In the Repeat Schedule Every field, enter how frequently the scan should run.

      1. Select an interval: Select the rate at which the scans repeat monthly.
      2. Select a time: Select the time at which the scans start. Example: Selecting 2 Months at 10:00 repeats the ongoing scan every 2 months at 10:00 AM.
   2. Choose the Scan Start From date

      1. Specific Date: Select a calendar date when the first scan should run. The scan will start on this date and then repeat according to the interval you set.
      2. Day of the Week: Select a specific day (Monday, Tuesday, etc.) when scans should run. This is useful for scheduling scans during low-activity periods (e.g., every Sunday).
   3. Ongoing scans can be resource-intensive (high CPU usage, network traffic, disk I/O); it's best to schedule them during off-hours when they won't impact user productivity. Use the Avoid Scans on option to specify when scans should NOT run, even if they're scheduled.

      1. Click +Avoid Time to add a restriction. Select the day(s) of the week when scans should be avoided. Select the time range to avoid (e.g., 8:00 AM to 6:00 PM for business hours). You can add multiple avoid time windows to accommodate different schedules.
3. At the bottom of the Scheduling step, you'll find the Terminate Current Scan toggle.

   1. Enable this option to stop any scan that is currently running when the newly configured ongoing scan starts.
   2. Leave this option disabled if you want the current scan to finish first.
   3. If the current scan runs past the scheduled start time of the new scan, the new scan will not run for that occurrence. It will wait until the next scheduled slot, whether that is the following week or month.
   4. This can create a gap in scheduled coverage, so keep this in mind when setting scan times.
4. Click Next to continue.

1. Once the schedule is configured, review the configuration summary and click Save Scan. The scan initiates automatically and appears in the Scans list.

View Scan Results

After the scan completes, click View Result to see the findings.

1. Navigate to DISCOVER > Scans.

1. Locate the completed scan and click View Result.
2. This opens the Results page filtered to show only findings from this specific scan (see the Results section below for detailed information on reviewing scan findings).

View Scan Details

1. Navigate to DISCOVER > Scans.
2. Locate the scan and click View .

   
3. This displays the complete scan configuration.

Delete a Scan

1. Navigate to DISCOVER > Scans.
2. Locate the scan you want to remove and click Delete .

   
3. A confirmation prompt will appear. Click Delete to confirm.

   

Pause a Scan

1. Navigate to DISCOVER > Scans.
2. Locate the running scan and click Pause .

1. The scan immediately pauses and stops processing targets. Targets that have already been scanned retain their results. Targets not yet scanned remain in the queue.

Resume a Scan

1. Navigate to DISCOVER > Scans.
2. Locate the paused scan and click Resume .

   
3. The scan resumes from where it was paused, continuing to process remaining targets in the queue.

Terminate a Scan

1. Navigate to DISCOVER > Scans.
2. Locate the running scan and click Terminate .

   
3. A confirmation prompt will appear. Click Terminate to end the scan immediately.