Manage discovered hosts

Use Settings › Discovery to get the command that deploys discovery, and to manage every host of your organization, however it was enrolled. You need the admin or owner role: the page sits at /settings/discovery, under Integration, and a lower role is sent back to the home page.

An organization that never deploys discovery sees no change except this page.

Get the command and a key

The Deploy discovery block shows the command in three tabs:

Tab	Command	Run it
macOS / Linux	The download-and-run command for discover.sh	With sudo, to deploy discovery on that machine
Windows	The download-and-run command for discover.ps1	In an elevated PowerShell
Fleet tool	The script-file form your fleet tool runs, on Windows and on macOS or Linux	Through your fleet tool, which supplies the key and the organization from its secret store

The key and the organization show as placeholders until you press Generate key and fill. That creates an organization key from the Host enrollment preset, named Discovery with today’s date, and fills the macOS / Linux and Windows commands with the key and your organization. The key is shown once and can only enroll hosts. A notification offers Manage API keys, which opens Settings › API keys, where the key stays listed. The Fleet tool tab keeps its placeholders, because your fleet tool supplies both values.

The Windows script carries no Authenticode signature yet. Run it with -ExecutionPolicy Bypass, as Deploy discovery shows. The Fleet tool tab’s Windows command runs it that way, and the tab says the script carries no signature yet.

If the key cannot be created, a notification says so and nothing is created; press Try again. Deployment guides opens Deploy discovery.

Read the hosts

The Hosts table lists every machine enrolled in your organization, through discovery or by hand.

Column	Shows
Hostname	The machine’s name, with its user and operating system below it
State	Active, Inactive, De-enrolled or Removed
Agents	The agents on the machine
Enrolled via	Discovery or Manual
IP	The private and public addresses
Found	When a scan first discovered an agent on it
Scanned	When the last scan ran
Active	When the host last sent an event

Search by hostname, IP address or user, and filter by Enrolled via, State, OS and Last active. Removed hosts are hidden until you turn on Show removed hosts.

Select a row, or View host in its menu, to open the host drawer:

Section	Shows
Identity	Hostname, operating system, user and state
Network	Private and public IPv4 and IPv6 addresses, each with a copy button
Discovery	How it was enrolled, when it was discovered, the last scan and the scan privilege
Agents on this host	Each agent with its control level and when it was last seen, linking to its record
Recent activity	The latest lifecycle events of the host and its agents

Remove a host

Remove works as it does on the licensing page: choose to let the host come back when it is seen again, or to cut it off. A removed host stops counting toward your licensed hosts. A host cut off stays out until a person enrolls it again by hand on that machine: a discovery scan does not bring it back.

Auto-remove hosts inactive for 90 days is on by default, below the table. It removes a host with no activity for 90 days and lets it come back when seen again. It acts only in an organization where at least one agent was enrolled through discovery, and it never touches a host that is cut off or de-enrolled.

De-enroll a host

Use De-enrol when a machine must stay out of your organization, even while discovery runs on it. Select one host or several, choose De-enrol, and confirm.

What happens	Detail
Its agents stop sending events	Every credential of the host is refused from its next call. The client keeps enforcing the policies it already holds and is not uninstalled
Discovery does not enroll it again	A scan on that host detects and records only. An enrollment by hand is refused too
Its history is kept	The record and the audit trail keep everything up to the de-enrollment

The host reads De-enrolled in the table, in its drawer and on each of its agents’ records.

Re-enroll a host

Choose Re-enrol on a de-enrolled host. The next discovery scan on that host enrolls it again. A host with no discovery on it needs someone to run openlatch init with an organization key on that machine.

Read the host from an agent

Each agent record has a Host tab, below Economics, readable by everyone who can open the agent. It shows the machine the agent runs on: its identity, its network, its discovery facts, its recent activity and Agents on this host, every other agent on the same machine with a link to its record. Manage hosts, shown to admins, opens Settings › Discovery: the tab itself has no action.

The agent record also carries an Enrolled via discovery badge for an agent a scan enrolled, a Removed badge once the agent is gone from its machine, and a De-enrolled badge when its host is de-enrolled. An agent that is not yet supported reads Known, with No enforcement adapter.

Notifications

Notification	When
New agent discovered	Discovery enrolled an agent
Agent re-enrolled	Discovery enrolled an agent again after its client was removed
Agent removed	An agent is no longer installed on its machine. Its history is kept
Host de-enrolled	An admin de-enrolled a host

They appear in the console. A channel receives them once you add them to its subscriptions in Settings › Notifications.