Discovery Setup Guides

Discovery Setup Guides

Per-platform instructions for configuring target hosts to allow uControl Insight discovery. These guides are also available on the Credentials page in the application.

Windows (PowerShell Remoting / WinRM)

Overview

uControl Insight discovers Windows hosts via PowerShell Remoting (WinRM) on TCP port 5985. It collects system info, installed software, running services, network adapters, processes, disk info, and hotfixes.

Prerequisites

• Windows Server 2016+ or Windows 10/11

• PowerShell Remoting enabled

• Firewall rule for TCP 5985

• Local or domain account with Remote Management access

Automated Setup

Download the setup script from sidebar → Credentials → Discovery Setup Guide → Windows section, or directly from /scripts/Setup-UControlDiscoveryAccount.ps1.

Run as Administrator:

powershell -ExecutionPolicy Bypass -File Setup-UControlDiscoveryAccount.ps1

The script will:

1. Create or configure a local/domain user account

2. Enable PowerShell Remoting (Enable-PSRemoting)

3. Add the account to Remote Management Users (or Administrators for full access)

4. Configure WMI namespace permissions

5. Add Windows Firewall rule for TCP 5985

6. Set LocalAccountTokenFilterPolicy for local account auth

7. Verify WinRM connectivity

Permission Levels

Credential Type

Use WINRM_LOCAL for local accounts or WINRM_DOMAIN for domain accounts.

Linux / UNIX (SSH)

Overview

uControl Insight discovers Linux/UNIX hosts via SSH on TCP port 22. Supports both password and key-based authentication.

Prerequisites

• SSH server running (OpenSSH, Dropbear)

• Firewall allows TCP 22 inbound

• User account with shell access (root not required)

Setup

# Create discovery user
sudo useradd -m -s /bin/bash ucontrol
sudo passwd ucontrol

# Or for key-based auth:
sudo mkdir -p /home/ucontrol/.ssh
sudo cp /path/to/public_key.pub /home/ucontrol/.ssh/authorized_keys
sudo chown -R ucontrol:ucontrol /home/ucontrol/.ssh
sudo chmod 700 /home/ucontrol/.ssh
sudo chmod 600 /home/ucontrol/.ssh/authorized_keys

Data Collected

Hostname, OS/kernel, CPU/memory, network interfaces, installed packages (dpkg/rpm/pacman), systemd services, running processes, physical disks, serial numbers, BIOS UUID.

Credential Types

SSH_PASSWORD or SSH_KEY

macOS (SSH)

Overview

uControl Insight discovers macOS hosts over SSH on TCP port 22 using the same SSH connector and credentials as Linux/UNIX. macOS is auto-detected during the scan, so there is no separate credential type — a macOS host reached over SSH is recognised and profiled automatically.

Prerequisites

• Remote Login enabled (System Settings → General → Sharing → Remote Login)

• Firewall allows TCP 22 inbound

• User account with shell access

Credential Types

SSH_PASSWORD or SSH_KEY — the same credentials used for Linux/UNIX.

SNMP (Network Devices, Printers)

Overview

uControl Insight discovers network devices, printers, and other SNMP-enabled devices via SNMP v2c or v3 on UDP port 161.

Prerequisites

• SNMP agent enabled on the device

• Community string (v2c) or SNMPv3 user configured

• UDP 161 accessible from the scanning host

• Read-only access is sufficient

Cisco Example

configure terminal
snmp-server community your_community RO
snmp-server host scanner_ip your_community
end

Seed Scan Detection

During seed scans, uControl Insight sends a lightweight UDP SNMP probe (community "public") to detect SNMP agents. If your device uses a different community string, configure the credential and the full SNMP connector will use it during Smart Scan Phase 2.

Data Collected

sysName, sysDescr, sysObjectID, sysLocation, sysContact, interfaces (IF-MIB), IP addresses (ipAddrTable), MAC addresses.

Device Type Inference

The sysDescr string is used to automatically classify devices as NETWORK_DEVICE (Cisco, Juniper, MikroTik, etc.) or PRINTER (HP, Ricoh, Xerox, Canon, etc.).

Credential Types

SNMP_V2C or SNMP_V3

VMware vSphere

Prerequisites

• vCenter Server or standalone ESXi host

• Read-only user role is sufficient

• TCP 443 accessible from scanner

Recommended Setup

Create a read-only role in vCenter and assign it to a dedicated service account at the Datacenter or vCenter root level.

Credential Type

VMWARE_API — Username, Password, optional Skip TLS Verification

Nutanix Prism

Overview

uControl Insight discovers Nutanix clusters via the Prism REST API over HTTPS on TCP port 9440. It supports both on-premises Prism Element / Prism Central and Nutanix Cloud Clusters (NC2), collecting clusters, hosts, VMs and storage containers.

Prerequisites

• Prism Element or Prism Central reachable on TCP 9440

• A read-only (viewer) Prism account

Full Setup Guide

See the dedicated Nutanix Prism page for step-by-step configuration, credential details and NC2 notes.

Proxmox VE

Prerequisites

• Proxmox VE 7.x or 8.x

• API user or token with PVEAuditor role

• TCP 8006 accessible from scanner

API Token Setup

In the Proxmox UI: Datacenter → Permissions → API Tokens → Add. Uncheck "Privilege Separation" for full read access.

Credential Types

PROXMOX_API or PROXMOX_TOKEN

Amazon Web Services (AWS)

Prerequisites

• IAM user or role with read-only permissions

• Internet access from scanner to AWS API endpoints

Minimum IAM Policy

ec2:Describe*
rds:Describe*
s3:ListAllMyBuckets, s3:GetBucketLocation
elasticloadbalancing:Describe*
cloudformation:ListStacks, cloudformation:DescribeStacks
ce:GetCostAndUsage (for cost analytics)
sts:GetCallerIdentity

Credential Type

AWS_ACCESS_KEY — Access Key ID, Secret Access Key, Default Region, optional Region Filter

Microsoft Azure

Overview

uControl Insight discovers Azure subscriptions via the Azure REST API over HTTPS (TCP 443), collecting virtual machines, disks, networks and resource groups.

Prerequisites

• An Azure AD (Entra ID) app registration / service principal

• The Reader role assigned at the subscription (or management group) scope

• Internet access from the scanner to Azure API endpoints

Credential Type

AZURE_SERVICE_PRINCIPAL — Tenant ID, Client ID, Client Secret, optional Subscription filter

Google Cloud Platform (GCP)

Overview

uControl Insight discovers GCP projects via the Google Cloud APIs over HTTPS (TCP 443), collecting Compute Engine instances, disks, networks and project metadata.

Prerequisites

• A GCP service account with a read-only role (e.g. roles/viewer)

• A JSON service-account key

• The relevant Compute APIs enabled on each project

Credential Type

GCP_SERVICE_ACCOUNT — JSON service-account key, optional Project filter

TP-Link Omada

Prerequisites

• Omada Controller 5.x with Open API enabled

• Settings → Open API → Add Client

• Note the Client Key and Client Secret

Credential Type

OMADA_API — Client Key, Client Secret, optional Skip TLS Verification