Running process-based discovery

Running process-based discovery extends File-Based Discovery (FBD) with process-based path detection, enabling the Agent Client Collector for Visibility Content agent to detect software running outside of standard configured scan directories.

Why use running process-based discovery

Some software is never installed into the standard program directories that FBD scans. Common examples include:

• Portable applications run from a removable drive or a user folder
• User-installed tools placed in a personal directory, such as a Python interpreter under a user profile
• Command-line utilities installed into a user's local binary directory

A directory-only scan cannot detect applications installed outside standard scan directories, but they are visible as running processes. Running process-based discovery closes that gap, giving SAM teams a more complete and accurate view of the software in use across your organization. This reduces risk and improves audit readiness.

Platform coverage

Running process-based discovery supports Windows, Linux, and macOS. Coverage scope varies by operating system and depends on the privileges granted to the agent service account. For platform-specific coverage details and privilege requirements, see Running process-based discovery platform coverage and properties.

• Enable running process-based discovery
  Enable running process-based discovery so that the Agent Client Collector for Visibility Content agent detects software running from directories outside your configured File-Based Discovery scan paths.
• Exclude directories from running process-based discovery
  Exclude specific directories from running process-based discovery so that processes running from those locations aren't recorded or included in File-Based Discovery scans.

Parent Topic:Agent Client Collector File-Based Discovery