Discovery vs Targeted
The two tracking modes and the discover-curate-target loop that turns an unknown fleet into a governed, low-volume estate.
scoutdiscoverytargetedreview-queuecurationmodes
Two modes
Targeted mode is the standard: track only the patterns the group's rulesets define. Discovery mode (track everything) is a temporary, deliberate choice.
| Targeted (standard) | Discovery (temporary) | |
|---|---|---|
| Tracks | Only executables matching the group's ruleset patterns, minus excludes | Everything running, minus excludes |
| Volume | Low, high-signal | High — a firehose |
| Purpose | Continuous governance of known products | Surveying an unknown fleet; finding shadow IT |
| Feeds | The estate directly | The Review queue for classification |
| Empty patterns | "Enrolled-idle" — heartbeat only, track nothing | n/a |
The discover → curate → target loop
Discovery and targeting are not competing choices — they are phases of one continuous curation loop:
- Discover — temporarily put a group into discovery mode. Agents report everything.
- Review — new, unclassified titles surface in the Review queue.
- Curate — for each, decide the product, vendor, whether it is paid, and its policy (
approved,tolerated,prohibited,needs_review). Actions are audited. - Promote — turn the products you want to keep governing into a ruleset; a one-click action builds a ruleset from the products you just curated.
- Target — switch the group back to targeted. You now track exactly the curated set — nothing more.
Re-run discovery periodically (quarterly is common) to catch drift.
Which mode now?
| Situation | Mode |
|---|---|
| You already know what to govern for this group | Targeted with the group's rulesets |
| Onboarding a new fleet, or hunting shadow IT | Discovery temporarily, then curate & return to targeted |
| Suspect drift since the last survey | Discovery as a scheduled re-survey |
| Steady state | Targeted |
Warning: Leaving a large fleet in discovery mode indefinitely recreates exactly the high-volume problem targeted mode is built to avoid. Treat discovery as a survey with a start and an end.