# Discovery using the Vault ### Overview **Keeper Discovery** provides DevOps, IT Security, and development teams with centralized visibility into privileged accounts and IT assets across local, AWS, and Azure environments. Integrated through the Keeper Gateway, it helps organizations identify unmanaged accounts, misconfigurations, and security risks. By automating asset discovery and delivering actionable insights, Keeper Discovery strengthens security, streamlines operations, and supports compliance across complex infrastructure setups. ### Prerequisites Prior to using Discovery, make sure to review the [Discovery Basics](https://docs.keeper.io/en/keeperpam/privileged-access-manager/discovery/discovery-basics) documentation. ### Discovery To create a Discovery Job, navigate to the **Discovery** tab and click **Create Discovery Job**. Then, select an active **Keeper Gateway** to perform the scan. The Gateway is linked to a **PAM Configuration**, which defines the environment type being scanned. If the PAM Configuration is missing required details, such as CIDR ranges or cloud credentials, you’ll be prompted to provide that information before the job can proceed.

### Job Queue Discovery jobs can be run in parallel across Keeper Gateways, but a single gateway can only run a single job at a time. If a job on a particular gateway is still running, you will receive an error message and you are giving the opportunity to cancel the job.

Once a Discovery Job reaches the **Completed** state, clicking on the job allows you to review and process the findings interactively. You can select multiple items or go through them individually, adding findings to a queue before finalizing the results.

While reviewing discovery results, you can choose the Vault location where each resource will be stored and assign the appropriate Admin Credentials. These credentials serve several key functions: * **User Account Discovery**: Used in future discovery jobs to remotely access the resource and identify local user accounts. * **Password Rotation**: Enables on-demand and scheduled password rotations for discovered accounts.

Additionally, PAM Users identified during discovery can be configured for **automatic password rotation**.

In the Discovery Job panel, you can view all previously run jobs along with their status, such as Completed, Running, or Failed.

### Next Steps Now that the Discovery is complete, additional resources can be found by running another job against the same Gateway and PAM Configuration. If Admin Credentials have been linked to KeeperPAM Resources, these credentials will be used to discover local user accounts within each resource. --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://docs.keeper.io/en/keeperpam/privileged-access-manager/discovery/discovery-using-the-vault.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.