Discovery patterns
How Discovery identifies devices and applications, and how patterns replaced most probe and sensor scripting.
How Discovery identifies devices and applications, and how patterns replaced most probe and sensor scripting.
- Patterns replaced probe and sensor scripting for new content
- Discovery is classify, identify, explore
- Debug patterns against a live target through the MID server
- Empty results usually mean credentials, not logic
The sequence
Discovery scans a range, classifies what answers, then runs identification and exploration. Classification decides what the device is, identification matches it to a CI or creates one through the identification engine, exploration collects the detail.
Probes and sensors versus patterns
Probes issue commands and sensors parse the output with JavaScript. Patterns do the same work declaratively in Pattern Designer with steps and variables, and they are far easier to debug and maintain. New content is pattern based, and custom extensions should be too.
Debugging
Pattern Designer has a debug mode that runs against a live target through a MID server and shows each step result.
- Start from the ECC queue when nothing appears, no input means the MID never ran the job
- Check credentials affinity, a wrong credential produces empty results rather than errors
- Confirm the CI class in the identification section before blaming the pattern