About Discovery and Audit

AlloyScan builds and maintains your IT inventory through two related processes: Discovery (also called Scan) and Audit. Together they answer two distinct questions about your network - what is out there and what is each thing made of?

How discovery and audit work

Discovery is the lightweight first phase. A Segment defines the network targets or provider resources to scan. The scan identifies devices or resources in scope and records basic identity information so you can decide what to audit.

Audit is the detailed second phase. AlloyScan collects hardware, software, configuration, or provider-resource data, depending on the target. It stores each resulting snapshot in Inventory, where you can inspect the audited device or resource.

You drive both processes through a few core concepts:

• A Segment defines a portion of your network and its discovery method (an address list, an Active Directory domain, or a cloud or provider-specific source).
• An Audit Service is a Windows-hosted component that performs agentless discovery and audit inside your network.
• An Audit Agent is installed on an endpoint that needs to be audited from outside your network.
• An AlloyScan cloud worker scans and audits supported provider Segments without a local Audit Service.
• A Credential provides authentication to a target device or provider API. Local execution uses an Audit Service credential pool; cloud workers use site-owned cloud credentials stored in AlloyScan.
• An Inventory is the per-site collection of audited devices and their snapshots.

Audit methods

AlloyScan supports both agentless and agent-based audits. You can use either method on its own or combine them in the same Site; both methods feed the same Inventory model.

Agentless audit runs through a Segment without installing an AlloyScan Audit Agent on each target. Address list and Domain Segments use a local Audit Service. Supported provider Segments can use an AlloyScan cloud worker or a local Audit Service. The execution choice determines which credentials the Segment uses: cloud credentials stored in AlloyScan or credentials from the Audit Service's local pool.

Agent-based audit uses an Audit Agent installed on each Windows, macOS, or Linux computer you want to track. The agent collects hardware and software inventory data locally and sends it to AlloyScan over outbound HTTPS port 443. Use this method for remote or offsite computers that have internet access but are not reachable by an Audit Service.

Segment types at a glance

AlloyScan supports seven Segment types:

AWS, Azure, and Google Cloud Segments add audited resources to their provider sections in Inventory. Google Directory and Jamf Segments add audited devices under Devices.

Why two phases

Splitting discovery from audit lets you spend audit effort intentionally. Discovery is cheap and broad - running a Scan does not consume your monthly audit quota. Audit is more expensive: it consumes against the Audits per month limit, generates detailed snapshots, and triggers Change tracking. A typical operator pattern is to discover everything in scope, place noise out of scope using the Ignore list, then audit only the devices that matter.

If you want discovery and detailed collection to happen in one flow, enable Automatically audit discovered devices in the Segment settings. This is useful for transient or short-lived devices, but it also means every discovered device that is audited consumes audit quota.

Key distinctions

• Scan discovers existence and basic identity. Audit collects detailed state.
• Agentless audit runs through a Segment. Agent-based audit runs on a computer with an Audit Agent.
• Scan schedule runs against a Segment (many devices). Audit schedule runs against a single device (at most one schedule per device).
• Agentless covers computers, network devices, hypervisors, and supported cloud or provider-specific resources. Agent-based covers computers that can run the Audit Agent.

Limitations

• AlloyScan does not push patches, deploy software, or perform vulnerability scanning. It records observed state.
• Provider Segments (AWS, Azure, Google Cloud Platform, Google Directory, and Jamf) are in Preview and subject to change.
• Manual device add is not implemented - devices must be discovered.
• Windows targets must be in the same Active Directory domain as the Audit Service host for agentless scan; cross-domain or workgroup targets require an Audit Agent.

Related

• How to create an Address list segment
• How to choose a Segment type
• How to create a Google Directory Chromebook segment
• How to create a Jamf segment
• How to scan
• How to audit
• Segment Types Reference