How It Works
Discovery operates in phases that vary by source type. A typical scan includes:- Infrastructure Scan — Connects to your environment and enumerates machines and accounts. Each machine becomes a PAM Resource, and each account becomes a PAM Account.
- Dependency Scan — Connects to each discovered machine and enumerates services and tasks that run under specific accounts. These are stored as Dependencies linked to the account whose credentials they use.
Core Concepts
Discovery Source
A configured scan target that defines where and how to discover resources and accounts in your environment.
Discovery Run
A single execution of a scan. Runs can be triggered manually or on a schedule.
Dependency
A service, task, or application that runs under a discovered account’s credentials.
Discovery Sources
A Discovery Source is the configuration that tells Infisical what to scan. It includes:- Connection details — How to reach the target environment (addresses, ports, protocols)
- Credentials — An account with the necessary access to perform the scan (encrypted at rest)
- Gateway — The Infisical Gateway that routes scan traffic into your network
- Schedule — Manual, daily, or weekly
Discovery Runs
Each scan creates a Run record that tracks:- Status — Running, completed, or failed
- Phase progress — Per-phase status with machine-level error details
- Discovery counts — How many resources, accounts, and dependencies were found, including counts of newly discovered and stale items
Staleness Tracking
Resources and accounts that were present in a previous run but not found in the current run are marked as Stale. Stale items are never automatically deleted — they remain visible with a “Stale” badge so you can investigate why a previously-discovered item is no longer responding.Dependencies
Dependencies represent services and tasks that rely on a specific account’s credentials. Discovery currently detects three types:| Type | Description |
|---|---|
| Windows Service | A Windows service configured to run under a specific account |
| Scheduled Task | A Windows scheduled task that runs under a specific account |
| IIS App Pool | An IIS application pool configured with a specific identity |
Dependencies discovered by a scan will never have their Enabled status overwritten by subsequent scans. Your explicit enable/disable decisions are always preserved.
Supported Discovery Types
Active Directory
Discover domain-joined Windows servers, domain and local user accounts, and service dependencies across your AD environment.
Prerequisites
Prerequisites vary by discovery type, but all sources require:- Infisical Gateway — A Gateway deployed in your network with access to the target infrastructure
- Scan credentials — An account with the necessary permissions to enumerate your environment (encrypted at rest)