Auto-Discovery of ESXi Hosts and Virtual Machines

The Auto-Discovery feature automatically identifies and scans the ESXi hosts a vCenter server manages, as well as the virtual machines residing on those hosts. Instead of manually entering IP addresses or hostnames in your scan target settings, Auto-Discovery queries the vCenter API to retrieve a live list of managed assets and adds them to the scan. When you enable this option, the scan automatically includes all discovered ESXi hosts and, if configured, every virtual machine hosted on those discovered hosts.

Why use Auto-Discovery instead of manual target entry?

• Scale and convenience. For environments with large numbers of ESXi hosts and virtual machines, Auto-Discovery reduces time spent on scan creation and preparation. Target lists remain current without manual updates.

• Reaching unroutable hosts. Some ESXi hosts sit behind a firewall or do not accept incoming traffic, so manual entry does not work — the scanner cannot communicate with the host. Auto-Discovery allows these ESXi hosts to "live" in the scan, which at minimum enables VIB reporting for each host and lets version-based vulnerability plugins execute. See this Auto-Discovery of ESXi Hosts and Virtual Machines for additional details of this capability.

Configuration options

Option	Description	Required
Use Auto Discovery	Toggles on access to the host and virtual machine auto-discovery options.	No
Auto Discover Managed VMware ESXi Hosts	Adds any discovered VMware ESXi hypervisor hosts to the scan targets you include in your scan.	No
Auto Discover Managed VMware ESXi Virtual Machines	Adds any discovered VMware ESXi hypervisor virtual machines to the scan targets you include in your scan.	No
Report Active and Inactive Virtual Machines	Enables collection of virtual machines for active and inactive VM reports. Disabling this option reduces the overall number of requests made by the scanner.	No

Prerequisites and restrictions

Caution: Tenable recommends using scanner groups containing a single scanner when using Auto-Discovery credentials, and entering only a single initial host in the scan. If multiple scanners are used in an Auto-Discovery scan, targets retrieved from the integration may be scanned multiple times.

Note: This feature is only available when scanning vCenter/ESXi versions 7.0.3 and later.

Note: Auto-Discovery does not automatically add the ability to authenticate remotely to ESXi hosts and virtual machines. You can add additional SSH credentials to authenticate to the ESXi host discovered and added to the scan, as well as SSH or Windows credentials to authenticate to virtual machines discovered and added to the scan.

Note: Compliance scanning is unavailable when Auto-Discovery is enabled. Run compliance scans with Auto-Discovery disabled and explicit vCenter/ESXi targets.