Discovering Unmanaged Network Assets

Harmony can automatically scan your local network and surface every connected hardware device that is not already tracked in your Asset Inventory. This removes the need for manual hardware audits and gives IT administrators a complete, continuously updated picture of what is physically present on the network - including devices that have never had the Harmony agent installed.

Network discovery uses ARP cache inspection combined with active ARP scanning to detect connected devices, then applies MAC address fingerprinting to resolve each device to its vendor and model. Newly discovered devices are pushed directly into Asset Inventory with no additional steps required.

Discovery runs through Harmony's custom script infrastructure and is supported on endpoints running macOS and Windows.

---

How Network Discovery Works

When a discovery scan runs, Harmony performs the following steps on a managed endpoint:

1. ARP cache inspection - The endpoint reads its local ARP cache to identify devices it has already communicated with on the same network segment.
2. Active ARP scanning - The endpoint sends ARP requests across the local subnet to uncover devices that are not yet in the ARP cache.
3. MAC address fingerprinting - Each responding device's MAC address is matched against a vendor and model database to produce human-readable identification details.
4. Inventory push - All discovered devices are automatically added or updated in your Asset Inventory, keeping your hardware records current without any manual input.

Because the scan runs directly from a managed endpoint, no dedicated network scanner appliance or additional infrastructure is required.

---

Supported Platforms

The network discovery script runs on managed endpoints with the following operating systems:

Operating System	Supported
Windows	Yes
macOS	Yes

At least one managed Windows or macOS endpoint must be present on a network segment for discovery to cover that segment.

---

What Gets Discovered

For each detected device, Harmony attempts to record:

• IP address assigned at the time of the scan
• MAC address of the network interface
• Vendor derived from the MAC address prefix (OUI)
• Model information where fingerprinting data is available

Devices are classified as unmanaged assets when they do not have an active Harmony agent associated with them. This includes printers, switches, access points, smart devices, and any other network-connected hardware.

---

Viewing Discovered Assets

After a scan completes, discovered devices appear in Asset Management > Asset Inventory. You can filter the inventory to show unmanaged assets to quickly identify hardware that falls outside your current management scope.

From the inventory list you can:

• Review vendor and model details for each discovered device
• Compare discovered devices against your known hardware records
• Take follow-up action such as tagging, assigning ownership, or flagging devices for investigation

Because results are pushed automatically after every scan, the inventory reflects your current network state without requiring you to manually import or reconcile data.

---

Running a Discovery Scan

Network discovery is delivered as a Harmony custom script. To run a scan:

1. Open Asset Management and navigate to the Scripts section.
2. Locate the network discovery script for your target platform (Windows or macOS).
3. Deploy the script to one or more managed endpoints on the network segments you want to scan.
4. Wait for the script execution to complete. Results are pushed to Asset Inventory automatically once the scan finishes.

You can schedule the script to run on a recurring basis to keep your unmanaged asset records up to date as devices join or leave the network.

---

Considerations and Best Practices

• Segment coverage - ARP scanning is limited to the local subnet of the endpoint running the script. To cover multiple network segments, deploy the discovery script to at least one managed endpoint on each segment you want to monitor.
• Scan frequency - Running discovery on a regular schedule (for example, daily or weekly) reduces the window in which new or rogue devices go undetected.
• Device churn - IP addresses recorded during a scan reflect point-in-time assignments. If your network uses DHCP with short lease times, treat IP address data as approximate and rely on MAC addresses as the stable identifier.
• Permissions - Ensure the endpoint running the script has sufficient privileges to execute ARP operations. On some operating systems, active ARP scanning may require elevated permissions.
• Network impact - Active ARP scanning generates a low volume of broadcast traffic. This is not expected to affect normal network operations, but you should be aware of it in highly sensitive or bandwidth-constrained environments.