Discovering Machines
The Corsha mIDP automatically discovers machines and their connections through network traffic observed by Corsha Gatekeepers. This passive discovery approach eliminates the need for agents, configuration changes, or manual inventory management.
Overview
Machine discovery provides:
- Passive Network Observation: Gatekeepers discover machines automatically as they communicate on the network
- Agent-Free Discovery: No software installation or configuration changes required on machines
- Connection Visibility: Automatic mapping of communication patterns between discovered machines
- Protocol-Agnostic: Discovery works across all protocols—HTTP, industrial (OPC UA, Modbus, EtherNet/IP), proprietary, and custom protocols
- Real-Time Inventory: Machine inventory updates continuously as new machines communicate
How Machine Discovery Works
Traffic Observation
Corsha Gatekeepers deployed in Firewall Mode operate at layer 2 of the network stack, observing all traffic that passes through them. As machines communicate, Gatekeepers:
- Identify Machines: Extract source and destination information (IP addresses, MAC addresses) from network traffic
- Record Connections: Log which machines are communicating with each other
- Capture Metadata: Collect port numbers, protocols, and traffic patterns
- Report to mIDP: Send discovered machine and connection data to the Corsha mIDP
Deep Protocol Inspection
For supported protocols, Gatekeepers perform deep protocol inspection to enrich machine discovery with application-layer details. This additional context helps identify machine roles, functions, and communication patterns beyond basic network metadata.
Continuous Discovery
Machine discovery is continuous and automatic:
- New Machines: Automatically discovered when they first communicate on the network
- Updated Connections: New connection patterns appear in real-time as traffic is observed
- No Polling Required: Discovery happens passively as machines communicate normally
- Zero Instrumentation: Machines don't need agents, SDKs, or configuration changes
Discovered Machine Information
For each discovered machine, the Corsha mIDP captures:
- Network Identifiers: IP addresses, MAC addresses
- Communication Patterns: Which machines it connects to, frequency, protocol usage
- Protocol Details: Application-layer information from deep protocol inspection (when available)
- First Seen / Last Seen: Timestamps for discovery and most recent activity
- Traffic Volume: Connection counts and activity levels
Discovery and Enforcement
Machine discovery works continuously across all enforcement modes. Whether in Observe-Only, Allow by Default, or Block by Default mode, Gatekeepers continue discovering machines and connections. The enforcement mode only affects traffic blocking behavior, not discovery capabilities.
Viewing Discovered Machines
Access discovered machines in the Corsha mIDP:
- Navigate to Machine Identities in the Control Plane Console
- View the complete inventory of discovered machines
- Filter by network segment, protocol, or activity timeframe
- Review connection patterns in Connection Canvas
Manual Machine Creation
While passive discovery handles most use cases, you can also manually create machine identities:
- Pre-Deployment: Define machines before they appear on the network
- Offline Systems: Add machines that communicate infrequently
- Planning: Create machine groups and policies before deployment
Manually created machines appear alongside discovered machines in the inventory.
Next Steps
After machines are discovered:
- Organize into Groups: Create machine groups to organize discovered machines by function, zone, or role
- Configure Policies: Set up connection rules to define allowed communications
- Monitor Activity: Use Connection Canvas to visualize machine communications and identify patterns
- Progress to Enforcement: Transition from Observe-Only mode to active enforcement as you validate discovered inventory and policies