> For the complete documentation index, see [llms.txt](https://doc.threatreaper.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://doc.threatreaper.ai/user-guide/ai-discover-ai-asset-discovery.md).

# 🔎 AI-Discover — AI Asset Discovery

**Menu:** DISCOVER > AI-Discover, with two pages: **Discovery** and **Live Assets**.

## 4.1 What it finds

* AI services in your cloud accounts (AWS, Azure, GCP).
* AI/ML software on your network (through a network discovery agent): for example, Ollama, Jupyter, vLLM, Triton, MLflow, Kubernetes and Docker APIs.
* AI applications, local model files, browser extensions and AI traffic on employee devices (through an endpoint agent).

Cloud scans need a cloud connector, and network or endpoint discovery needs an agent. Your administrator sets these up (see the Admin Guide). Without them, the page prompts you to add one.

## 4.2 Running a scan

{% stepper %}
{% step %}

## Open the scan dialog

Select **Scan** to open the scan dialog.
{% endstep %}

{% step %}

## Choose scan targets

Choose **Cloud**, **Local** (on-premises/endpoint), or both.
{% endstep %}

{% step %}

## Select cloud connectors and services

For cloud, select the connector(s) and the services to include:

* **AWS:** EC2, ECS, EKS, Lambda, SageMaker, Bedrock
* **Azure:** Virtual Machines, AKS, Functions, Machine Learning, Cognitive Services
* **GCP:** Compute Engine, GKE, Cloud Functions, AI Platform, Vertex AI
  {% endstep %}

{% step %}

## Select local or network agents

Select the agent(s) if you are scanning local or network targets.
{% endstep %}

{% step %}

## Choose whether to include vulnerability scanning

Optionally keep **include vulnerability scan** on so discovered assets are checked against AI-specific CVE data.
{% endstep %}

{% step %}

## Start the scan

Start the scan. Progress is shown, and a notification is sent on completion if your administrator enabled it.

A discovery scan consumes credits.
{% endstep %}
{% endstepper %}

## 4.3 Reading results

The page has tabs for the dashboard, **Assets**, **Vulnerabilities**, **Live Assets** and **Agents**.

{% tabs %}
{% tab title="Assets" %}
**Assets table:** name, type, provider, location, risk level (Critical, High, Medium, Low) and discovery time.

Filter by type, risk, provider, connector or agent, then open a row for details: risk score, associated vulnerabilities, description and remediation guidance.
{% endtab %}

{% tab title="Vulnerabilities" %}
Each finding has a severity, description and recommendation.

Use **Fix** to get AI-generated remediation instructions (choose LockThreat AI or an external AI), for example cloud CLI commands.
{% endtab %}

{% tab title="Live Assets" %}
Assets and activity currently observed by agents.
{% endtab %}

{% tab title="Agents" %}
Status of the connected endpoint and network agents.
{% endtab %}
{% endtabs %}

## 4.4 Errors you might see and how to fix them

| **Message**                                                              | **What it means**                                                          | **What to do**                                                                                        |
| ------------------------------------------------------------------------ | -------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------- |
| "Go to Settings → Connectors to add AWS, Azure, or GCP credentials."     | No cloud connector is configured yet                                       | Add a cloud connector — see [15. Connectors](#15-connectors-linking-your-cloud-code-and-ai-providers) |
| "No Router agent registered. Deploy one to scan your internal network."  | No network discovery agent is deployed                                     | Ask your administrator to deploy an agent (Admin Guide)                                               |
| "No Raksha agent registered. Deploy one to scan individual endpoints."   | No endpoint agent is deployed                                              | Ask your administrator to deploy an endpoint agent (Admin Guide)                                      |
| "Failed to load projects"                                                | The project list couldn't be fetched                                       | Refresh the page; if it persists, check your connection or contact your administrator                 |
| "No resource data available for selected connectors."                    | The connector has no scannable resources, or lacks permission to list them | Verify the connector's cloud credentials have read/inventory access, then re-run the scan             |
| "Deep scan failed. Check Azure VM permissions and RunCommand extension." | LockThreat couldn't run a deeper inspection on that VM                     | Confirm the VM allows the RunCommand extension and the connector has the required role                |
| "No output received from VM. The VM may be stopped or inaccessible."     | The target VM didn't respond                                               | Confirm the VM is running and reachable, then retry                                                   |

## 4.5 What success looks like

After a completed scan, the **Assets** tab shows a populated table, for example:

| **Asset Name**       | **Type**   | **Provider**  | **Risk Level** | **Discovered**   |
| -------------------- | ---------- | ------------- | -------------- | ---------------- |
| prod-inference-vm-01 | VM         | Azure         | 🟠 High        | 2026-10-10 14:32 |
| customer-support-bot | AI Service | AWS (Bedrock) | 🟡 Medium      | 2026-10-10 14:35 |
| analytics-cluster    | Kubernetes | GCP           | 🟢 Low         | 2026-10-10 14:38 |

Opening a row shows a risk score, the specific vulnerabilities found, a description and remediation guidance; for compute assets, a **Deep Scan** panel can additionally list detected AI/ML packages (for example PyTorch, TensorFlow), running services, open ports, local model files and configuration files found on that asset.

A completed scan also raises a notification (if enabled) and updates the Dashboard's discovery widgets.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://doc.threatreaper.ai/user-guide/ai-discover-ai-asset-discovery.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.