Discovery
Discovery is the engine that finds the cryptographic material CBOM Secure manages. It automatically scans your infrastructure to identify, catalog, and analyze cryptographic assets — certificates, keys, secrets, cipher suites, and cryptography embedded in source code and binaries — wherever they live. The results feed into a centralized inventory that powers the Key, Certificate, CipherSuites, Analysis, and Reports sections of the platform.
Rather than relying on manual tracking, Discovery reaches out to hosts, cloud services, network endpoints, databases, directories, key stores, and code repositories, collects the cryptographic material it finds, deduplicates it, and stores it in a standardized form so it can be searched, evaluated against policy, and exported.
Why Discovery Is Used
-
Build a complete inventory: Continuously locate every key, certificate, and cipher suite across the organization so nothing is missed.
-
Eliminate blind spots: Reach cryptographic material in places that are easy to overlook — cloud key vaults, HSMs, databases, directory services, source code, and compiled binaries.
-
Keep the inventory current: Re-scan on demand or on a schedule so the inventory reflects the real state of the environment.
-
Feed analysis and compliance: Provide the raw material that the platform evaluates for risk, policy compliance, and post-quantum readiness.
What Discovery Finds
Discovery identifies a broad range of cryptographic material:
-
Certificates: X.509 certificates from file systems, certificate stores, cloud certificate managers, directories, and live network endpoints.
-
Keys: Public, private, secret, HSM, and software keys (RSA, ECDSA, Ed25519, DSA, and others) from files, HSMs, vaults, and cloud key management services.
-
Secrets: Material such as SSH keys, database encryption (TDE) keys, and other sensitive cryptographic secrets.
-
Cipher suites: The TLS/SSL protocol configurations and cipher suites negotiated by network services.
-
Source-code and binary cryptography: Cryptographic usage, hardcoded material, and algorithms embedded in source repositories and compiled executables.
Where Discovery Scans
Discovery is modular: each sensor knows how to find a particular class of cryptographic material from a particular source. Sensors span:
-
Cloud platforms: AWS, Azure, and Google Cloud key management and certificate services.
-
Network services: Live HTTPS/TLS endpoints, including their certificate chains and cipher suites.
-
Files and binaries: PEM/DER/PKCS#12 files, keystores, and cryptography embedded in executables.
-
Databases: Transparent Data Encryption (TDE) keys in MySQL, MSSQL, and Oracle.
-
Directories and identity systems: LDAP and Active Directory certificates, keys, and related material.
-
Key stores and HSMs: HashiCorp Vault and KMIP-compliant hardware security modules (via PKCS#11).
-
Operating systems and code repositories: Windows, Linux, and macOS hosts, plus source code in Git repositories.
Discovery Sub-Sections
The Discovery menu holds Host and Template at the top level, then groups the rest under two submenus: Tasks for running discovery, and Settings for the supporting configuration. Entries you lack permission for are hidden.
The three areas this guide covers in depth are:
-
Host: Register and manage the target systems that discovery runs against — their hostname, operating system, credentials, and whether they are deployable. See Host for details.
-
Template: Define reusable discovery configurations — which sensors to run and how they are configured — independent of any specific host.
-
Tasks > Networked Deployments: Combine a template with one or more hosts to create a runnable discovery job, then execute or schedule it. See Task for details.
-
Settings > CycloneDX Export: Export the discovered cryptographic material as CycloneDX-format CBOM files — filtered by type and date range — for use with external audit, compliance, and bill-of-materials tools. See CycloneDX Export for details.
The remaining entries are not yet covered by this guide:
-
Tasks > Cloud Deployments: Discovery runs that reach cloud provider APIs through a configured cloud server rather than a host.
-
Tasks > Off-Grid Deployments: Discovery for air-gapped targets: CBOM Secure builds a bundle to carry to the host, and the results are imported back afterwards.
-
Settings > Tags: The shared labels applied to hosts, tasks and discovered material for grouping and filtering.
-
Settings > Integrations: Connections to external inventories that supply hosts automatically, such as CrowdStrike Falcon.
-
Settings > Cloud Servers: The cloud credentials and endpoints that cloud deployments run against.
In short, a Host is where to look, a Template is what to look for, and a Task brings the two together to actually run the discovery. The material that comes back can then be reviewed across the platform and exported via Settings > CycloneDX Export.