Discovery Configuration

This guide explains step-by-step how to discover, manage, and monitor certificates in SecTrail CM.

About the Feature

To learn what the Certificate Discovery feature is, how it works, and its advantages, first review the Features: Certificate Discovery page.

Discovery on Remote Networks

To discover certificates on networks the CM cannot reach directly, you can use Distributed Discovery Agents (DDA).

Certificate Discovery

Accessing Discovery Configurations

Access Path

To manage discovery operations, go to: Discovery → Automated Discovery in the application panel.

Discovery Configurations List

You can view all discovery periods and configurations defined in SecTrail CM in a centralized list.

Discovery Configurations List - All Defined Discovery Tasks

List Information

The following information is displayed for each row in the discovery configurations list:

• Name - Descriptive name you gave to the discovery task
• Discover Type - Which discovery method is used (Network Scan or Transparency Log Scan)
• IP Range - IP range or domain name to be scanned
• Ports - Which ports are scanned (e.g., 443, 444, 8443)
• Discover Period - How frequently discovery runs

Available Operations

You can perform the following operations from the list:

• ✏️ View and Filter - Review discovery configurations
• 🔧 Edit - Update existing configurations
• 🗑️ Delete - Remove unnecessary configurations
• ➕ Create New - Add new discovery configuration

Network Scan Configuration

With Network Scan, you can discover SSL/TLS certificates in your internal network.

Creating New Network Scan

As shown in the image below, you can create a Network Scan configuration:

Network Scan Configuration Form

Configuration Parameters

Parameter	Description	Options
Name	Provide a descriptive name for the discovery task	Use IP range or target system name
IP/CIDR or Domain	Enter the IP address, CIDR notation, or domain name you want to scan	• Single IP: 192.168.1.100 • IP range: 10.34.24.0/24 • Subnet: 172.16.0.0/16 • Domain: example.com
Port	Enter ports to scan, separated by commas	• Single port: 443 • Multiple: 443,444,8443 • Range: 400-500
Discover Type	Select discovery method	• Network Scan: Scans IP ranges and ports • Transparency Log Scan: Queries CT logs for a domain
DNS Resolver	Select the DNS source to use	• System DNS: Uses the server's system DNS settings • Custom DNS: Specify your own DNS server
Status	Determine status of discovered certificates	• Managed: Managed certificates • Monitored: Only monitored certificates
Execution Server	Select which CM server executes the scan (for distributing workload in cluster setups)	One of the defined servers (default: default)
Scan Location	Select where the scan is run from	• Local (this server): Scans from the CM server • An active Distributed Discovery Agent — scans the remote network over its SSH tunnel
Discover Period	Set how frequently the scan runs	• Period type: Daily or Weekly • Time: HH:MM format • Add More to add multiple times

Tips

• Scanning outside business hours reduces network traffic
• Use Add More button to scan at different times each day

After entering the form information, click the Submit button to save the configuration.

STARTTLS Certificate Discovery

Network Scan can automatically discover certificates on services that support STARTTLS, in addition to direct (implicit) TLS handshake.

• DNS Flexibility: Supports both a global DNS resolver (startup parameter) and per-request DNS override.
• STARTTLS Negotiation: Attempted only after a failed direct handshake, and only for ports with a well-known STARTTLS protocol (see mapping below). Ports without a mapping (e.g. 443) are treated as implicit TLS only.

STARTTLS Port Mapping

When the direct TLS handshake fails, the following ports trigger a STARTTLS upgrade attempt using the matching protocol:

Port(s)	Protocol	Upgrade Command
25, 587	SMTP	STARTTLS
143	IMAP	a001 STARTTLS
110	POP3	STLS
21	FTP	AUTH TLS
389	LDAP	StartTLS extended request
5432	PostgreSQL	SSLRequest message
5222	XMPP	<starttls/>

Useful Information

No extra parameters are required — the tool inspects the scanned port and applies the correct upgrade automatically.

CT Logs Configuration

With CT Logs, you can discover your publicly published domain certificates.

Creating New CT Log Scan

As shown in the image below, you can create a CT Logs configuration:

CT Logs Configuration Form

Configuration Parameters

Parameter	Description	Options
Name	Provide a descriptive name for the discovery task	Example: Example.com CT Scan, Company Domains
IP/CIDR or Domain	Enter the domain name you want to scan	• Example: example.com • Subdomains are automatically included • No need to use wildcard (*.example.com)
Discover Type	Select discovery method	Select Transparency Log Scan
Status	Determine status of discovered certificates	• Managed: Managed certificates • Monitored: Only monitored certificates
Discover Period	Set how frequently the scan runs	• Period type: Daily or Weekly • Time: HH:MM format

Subdomain Discovery

When you enter example.com, all subdomain certificates for this domain are also automatically found: www.example.com, api.example.com, mail.example.com, and others.

CT Logs Recommendations

• Daily scanning is recommended for CT Logs (to catch new certificates)
• Be sure to perform daily scanning for Shadow IT detection
• New certificates may take a few hours to be recorded in CT logs

After entering the form information, click the Submit button to save the configuration.

Manual Discovery

You can navigate to Discovery > Manual Discovery to perform quick and instant scans without creating scheduled discovery tasks.

When to Use Manual Discovery?

• Quick check when adding a new server
• Emergency certificate check
• Test scans
• One-time inventory updates

Manual Discovery Form - Quick Scan

Manual Discovery Parameters

Parameter	Description	Options
IP/CIDR or Domain	Enter IP, CIDR, or domain to scan	• Single IP: 1.1.1.1 • IP range: 1.1.1.0/24 • Domain: example.com
Port	Specify ports to scan	• Single port: 443 • Multiple ports: 443,844,444
DNS Resolver	Select the DNS source to use	• System DNS: Uses the server's system DNS settings • Custom DNS: Specify your own DNS server
Scan Location	Select where the scan is run from	• Local (this server): Scans from the CM server • An active Distributed Discovery Agent — scans the remote network over its SSH tunnel
Discover Type	Select discovery method	• Network Scan: For IP/Port scanning • Transparency Log Scan: For domain scanning
Status	Determine certificate status	• Managed: Managed • Monitored: Monitored

After filling out the form, click the Discover button to start scanning immediately.

Important Note

• Manual discovery results are automatically added to inventory
• However, it does not create periodic scanning
• For regular scanning, you must create a scheduled discovery configuration

Bulk Discovery Configuration

You can perform bulk import via Excel (XLSX) file to create multiple discovery configurations at once.

When to Use Bulk Import?

• When you want to add many IP ranges or domains at once
• When you want to create discovery configurations from an existing inventory list
• When you want to bulk import network lists from different departments

File Import Screen - Bulk Discovery Configuration

How to Perform File Import?

Access the bulk import page from Discovery → Automated Discovery → File Import menu.

1. Download and Fill Template

Click the Download Template button to download the Excel (XLSX) template file. Fill in the following columns in the template:

Template Tips

• Each row in Excel represents a discovery configuration
• Don't fill empty rows, Excel will automatically skip them
• For multiple ports in the Port column, separate with commas: 443,8443,636
• Use IP/CIDR for Network Scan, use domain for CT Logs

2. Upload File

1. Click the Choose File or Browse button
2. Select the filled Excel file
3. Ensure XLSX is selected in the File Type field
4. Click the Import button

3. Check Results

• ✅ Successfully imported configurations are shown with green checkmarks
• ❌ Rows with errors are marked in red and error message is displayed
• 📋 Check all added records from the discovery configurations list

How to Configure Discovery Filters?

If you want certain IP addresses, ranges, or domains to never be discovered during any discovery operation, you can use the Discovery Filter feature. Targets defined with a filtering rule are automatically excluded from all discovery processes.

Access Path

Go to Discovery → Automated Discovery → Filter menu.

When to Use?

• If there are specific IP addresses or ranges you do not want discovered
• If certain systems must be excluded from the inventory
• For network segments that should be kept out of scanning

Filter List

Defined Discovery Filters List

Creating a New Filter

Discovery Filter Creation Form

Parameter	Description	Example
IP or CIDR	IP address or range to exclude from discovery	192.168.1.50, 10.0.0.0/8
Port	Port to exclude from discovery (optional)	443, 8443

After filling in the form and clicking the Submit button, the rule becomes active and these targets will be skipped in the next discovery operation.

Monitoring Discovery Results

You can track the results of all discovery operations from the Discovery → Processes menu.

Discovery Results Page - Scan Statuses and Statistics

Displayed Information

On this page, you can see the following columns for each discovery operation:

Started / Ended : Date and time the scan started and completed

IP Range : Scanned IP range or domain name

Port : Scanned port(s)

Type : How the scan was triggered — Automatic (scheduled), Manual, or integration-driven (F5: <name>, Managed: <name>, etc.)

Status : Scan status (Completed, In Progress, Failed)

Message : Result summary, e.g. "Discover completed. Founded 45 hosts."

Source Server : The source of the scan — the CM server's hostname (SecTrailCM) for local scans, or DDA: <agent name> (<ip>) for scans run via a DDA agent

Scan Statuses

Discovery operations can be in the following states:

Status	Icon	Description	Action Required
In Progress	🔄	Scan is currently ongoing	Wait for completion
Completed	✅	Scan completed successfully	Review results
Failed	❌	Scan ended with error	Check error logs

Useful Information

From this page, you can view the results of both scheduled discovery tasks and manual discovery operations. Past scan records are also saved, allowing you to analyze your discovery performance.