Configuring Discovery Settings

Use Discovery Settings to configure your settings for Global Discovery cycle. The discovery cycle pulls and correlates data from all adapters.

To open the Discovery Settings:

1. From the top right corner of any page, click . The System Settings page opens.
2. In the Categories/Subcategories pane of the System Settings page, expand Lifecycle, and select Discovery.

• Discovery Schedule (required, default: Every x hours) - Select the discovery schedule option. Note that all times are in UTC.
  • Every x hours - Select this option to run discovery cycles every number of hours defined in Repeat scheduled discovery every (hours).
    • The discovery cycle start time is determined based on the specified value, starting at midnight. For example, if the specified value is 6, the discovery cycle start times are: 12am, 6am, 12pm, 6pm, 12am, etc.
    • The start time for the next discovery cycle task is the closest interval. For example, If the specified value is 6, and the configuration was saved at 10am, the next discovery cycle will start at 12pm.
    • The maximum possible value is 24.
  • Every x days - Select this option to run discovery cycles at the time specified in Scheduled discovery time every number of days defined in Repeat scheduled discovery every (days). The start time is determined based on the specified value, starting the 1st of each month. For example, if the specified value is 10, the discovery cycle is triggered on 1st, 11th, 21st, 31st (if exists), 1st, 11th, etc.
  • The first start time is the closest interval. For example, If the specified value is 10, and the configuration was saved on the 12th, the next discovery cycle will be on the 21st. The maximum possible interval is 30.
  • Days of week - Select this option to run discovery cycles at the time specified in Scheduled discovery time on the selected days of the week in Repeat scheduled discovery on.

Setting More Than One Scheduled Discovery Time

When you choose Every x days or Days of week, you can set a number of discovery times that will run at set hours on the days that you choose. In this way, you can run a discovery at defined hours, and not every X hours, for instance to fit in with specific events during the workday.

• Click the + button to set more than one discovery time, to run the discovery at defined hours during the day.

• Click the Delete icon to the right of a scheduled discovery time to delete it.

Running Enforcement Sets

• Constantly run enforcement sets (required, default: False)
  • Select this option so that Axonius constantly runs the automatic Enforcement Sets. You should select this option when you have a realtime adapter and the assets fetched from that adapter are part of Saved Queries used as the trigger for different Enforcement Sets.
  • Leave this option not selected (i.e., disabled; the default) so that Axonius runs the automatic Enforcement Sets at the end of each discovery cycle.

Tagging Reimaged Devices

Tag reimaged devices (required, default: False)

For a device to be tagged, all of the following criteria must be met:

1. Agent-sourced data only - The feature only evaluates devices that have been reported by an endpoint agent adapter and must have all three of the following populated: a serial number, a hostname, and a last seen date. Devices that are missing any of these fields, or that are discovered solely through passive or cloud-directory sources, are excluded from the analysis entirely.

2. Serial number reuse across hostnames - The same hardware serial number must be reported under multiple different hostnames across your environment. Axonius scans all agent-reported devices and maps each serial to the hostnames associated with it. A serial is only flagged as "shared" - and therefore eligible for reimage tagging - if it appears under at least 4 distinct hostnames. This threshold is intentional and protects against false positives from scenarios like cloned VMs or imaging templates that may briefly share a serial before being properly individualized.

3. Valid serial format - Even if a serial appears across multiple hostnames, it must pass a format validation check before being considered. The serial must be at least 5 characters long and must contain at least 2 unique letters and at least 2 unique digits. This filters out common placeholder values that manufacturers or imaging tools often insert, such as "Unknown," "To Be Filled," "N/A," all-letter strings, or purely numeric sequences - none of which represent a real, unique hardware identifier.

4. Time gap between old and new records - Once a shared serial is confirmed, Axonius compares the last seen dates of all devices reporting it. The most recently seen date across the group is used as the reference point. A device is classified as "old" if its last seen date is 7 or more days before that reference point. A device is classified as "new" if its last seen date is within 2 days of that reference point and has a hostname. Both an old and a new record must exist for tagging to proceed - if all records fall within a similar time window, no tag is applied.