Authentication Requirements
As part of the Discovery App installation, customers enter the appropriate credentials for the types of systems to be scanned. These credentials are stored and encrypted locally within the DA Windows Server and never go to the cloud. Table 6 lists the most common types of credentials and communication methods required for the probes to successfully scan each asset type. Note, the list may not be inclusive of requirements and is subject to change.
Unless specifically referenced below, do not assume a specific asset or hardware type is discoverable with out-of-box-probes. Always confirm with Ivanti prior to purchase that something is supported or Ivanti is committed to add. Otherwise, Ivanti assumes no responsibility or obligation to discover unsupported asset types.
Table 5: Discovery Credential and Port Requirements
Asset Type | Method | Port/Protocol | Authentication Method | Notes |
|---|---|---|---|---|
Windows (Batch method) * see note below) | Batch scripts with WMI commands and PAExec from Disc. App. | TCP: 135, 139 (WMI) and 445 (File and Print sharing) UDP: 137,138 | Windows admin credentials with elevated privileges | Elevated privileges required for relationship discovery WMI and PAExec is required to push Windows Discovery Agents via the Discovery App. |
Windows (PS remoting method) | PowerShell from Disc. App. | Port 5985 | Windows username/password | PS-Remoting must be enabled on target hosts and Discovery App |
Unix, Linux, Mac, Solaris | SSH from Disc. App. | 22 (SSH) | SSH username/ password or private keys | Update the sudoers file to not require TTY. Requires SUDO on netstat or SS command to fetch IP connections. SUDO dmidecode required to fetch serial number. SNMP will not discover relationships. |
Network Infrastructure (via SSH) | SSH (Cisco CDP) from Disc. App. | 22 (SSH) | SSH User ID/password | SSH required to discover relationships. |
SNMP (Network Infrastructure, Windows, Linux, misc. edge devices) | SNMP from Disc. App. | 161 (SNMP) | Community String (v1, v2) or User ID/password (v3) | SNMP does not provide sufficient capability to discover relationships for any device type so other methods are preferred. |
AWS resources | API from cloud UI | 443/80 | Account ID, AWS access key, secret key, account ID | See AWS IAM Policy below, EC2 OS details require server discovery scan |
Azure resources | API from cloud UI | 443/80 | Account ID, client ID, tenant ID, secret key | See Azure Role Setup below, Virtual machine details require server discovery scan |
VMware vCenter | API from Disc. App. | 443/80 | VCenter SSO User ID and password | This will discover ESXi hosts managed by vCenter |
ESXi Hosts | SSH from Disc. App. | 22 (SSH) | SSH Host Credentials | For standalone ESXi host discovery |
Active Directory | WMI/API | 135, 88 | AD host, Domain, Base DN, Bind DN, Password | Domain admin required |
MS SQL Database | WMI from Disc. App. | 1433, 1434 | Windows or SQL Server account | Requires SQL server credential profile with user read rights on the sys.databases table |
MySQL | SSH from Disc. App. | 22 | MySQL User with SHOW DATABASES Privilege | Allow remote MySQL access. Ensure firewall rules allow MySQL traffic. |
MMC Certificates | WMI and PowerShell from Disc. App. | 135, 137, 138, 139 (WMI) and 445 (file/print sharing) | Windows admin credentials with elevated privileges | Requires enabling PowerShell scripting |
TLS/SSL Certificates | WMI from Disc. App. | 443 | Windows admin credentials with elevated privileges | Certs that reside on a server can be discovered. E.g. if port 443 is open on a server, it is assumed it contains an SSL cert which Ivanti Neurons for Service Mapping tries to retrieve from the port query |
IIS Websites | WMI from Disc. App. | 135, 137, 138, 139 (WMI) and 445 (file/print sharing) | Webserver credentials | Requires IIS Management Tools installed with IIS Management Scripts and Tools selected |
Cisco Meraki | API from cloud UI | 443/80 | API key | Requires Meraki Cloud Dashboard API access |
Oracle DB | WMI/ PowerShell/SSH from Disc. App | Default Port: 1521 (TCP) and Configurable SSH (Linux) or WMI/WinRM (Windows) | Windows/ Linux Username, Password | Process access to list/read Oracle processes File read access to Oracle configuration files Command access to run sqlplus and lsnrctl. |
NetApp Storage Server (Beta) | ONTAP REST API from Disc. App | 443 | Username, Password | Requires reachable API endpoints and valid credentials. |
HP MSA Storage (Beta) | API from Disc. App | 443 | Username, Password | Ensure the HP MSA server and all required REST API v2 endpoints are reachable (online and responding) before initiating API-based discovery of HP MSA arrays. |
Nutanix (Beta) | API, SSH from Disc. App | 9440, 22 | Username, Password | Requires reachable API endpoints and valid credentials if Scans via APIs Ensure port 22 is open and valid credentials are available if scans via SSH. |
CCM | PowerShell Script | 5985 | Username, Password Site code | SCCM site server and SQL Server are installed, reachable, and healthy. Required ports are open between clients, site system roles, and SQL (per your topology). DNS/AD are configured properly; time sync is correct. Proper service accounts/permissions and valid client push/admin credentials are available. Boundary groups and networking (subnets/VPN) are defined for client assignment and content. |
Intune | API from cloud UI | 443/80 | Client ID, tenant ID, secret key | See Microsoft Intune setup below |
JAMF | | | | |
| | | | |
Notes on scanning Windows OS via Batch (WMI and PAExec)
The Discovery App will copy a few files to the Windows admin$ share and then launch a local service with the credentials provided. It will then scan the system with all the probe details. Once the scan is complete it will then stop and remove the service and files from the admin$ share folder. For this to work, the account being used must have remote file access to the admin$ share, must have admin rights on the box being scanned, and must have logon as a service right on the local Windows box.