Install the Cybermatic network discovery agent

One agent per network segment finds every device on that segment — printers, phones, cameras, IoT, and computers with no agent of their own — and lists them as discovered, unmanaged assets.

1. 1Before you begin. The discovery agent is a different program from the device agent, and they do different jobs. The device agent reports on the machine it is installed on. The discovery agent reports on every device it can see on the network around it. You install one device agent per machine, but only one discovery agent per network segment. By default it is passive: it listens for what devices announce about themselves (mDNS/Bonjour, SSDP, NetBIOS), reads the local neighbour table, and asks your DNS server what each address is called. Nothing is scanned. Active port probing exists as a separate, admin-only opt-in described in the last step. You need: a workspace administrator account, and administrator/root on one machine per segment. Linux is the recommended host — it is the lightest to run and the easiest to leave in place — but Windows and macOS work identically.
2. 2Step 1 — Create a discovery token. 1. Open Settings → Agents → Network discovery. 2. Give the responder a name that identifies the segment (e.g. HQ office VLAN) and select Create token. 3. Copy the token — it starts with cyb_d_ and is shown once. Discovery tokens are separate from device-agent tokens and cannot be used interchangeably. Use one token per segment so you can revoke a single site without disturbing the others.
3. 3Step 2 — Linux (recommended). Debian/Ubuntu: sudo dpkg -i cybermatic-discovery_1.1.0_amd64.deb sudo cybermatic-discovery --enroll cyb_d_yourtoken sudo systemctl start cybermatic-discovery RHEL/Rocky/Amazon Linux: sudo rpm -i cybermatic-discovery-1.1.0-1.x86_64.rpm sudo cybermatic-discovery --enroll cyb_d_yourtoken sudo systemctl start cybermatic-discovery Generic (any distribution, or ARM64): download the matching tar.gz, then sudo install -m 755 cybermatic-discovery /usr/local/bin/cybermatic-discovery sudo cybermatic-discovery --enroll cyb_d_yourtoken Check it with: systemctl status cybermatic-discovery
4. 4Step 3 — Windows (10/11, Server 2016+). Download cybermatic-discovery-setup.exe from Settings → Agents → Network discovery and run it as administrator. It is Authenticode-signed (verified publisher: Ironhawk Group Corp). Silent install with enrollment, for RMM or GPO: cybermatic-discovery-setup.exe /TOKEN=cyb_d_yourtoken The installer registers a scheduled task that runs at startup as SYSTEM and starts it immediately, so you do not need to reboot. Confirm with: schtasks /Query /TN "CybermaticDiscovery"
5. 5Step 4 — macOS (13+, Apple Silicon & Intel). One universal package covers both chip families, signed and notarized by Apple. Install and enroll from Terminal: sudo installer -pkg ~/Downloads/cybermatic-discovery-1.1.0.pkg -target / sudo cybermatic-discovery --enroll cyb_d_yourtoken A launchd daemon (ai.cybermatic.discovery) runs it from then on, including after reboots. Confirm with: sudo launchctl print system/ai.cybermatic.discovery
6. 6Step 5 — Verify, and preview before enrolling. Within a few minutes the devices appear under Assets → Unmanaged devices, each with whatever the network could tell us: name, vendor, IP, MAC, and device type. To see what an agent would find before enrolling it anywhere, run it read-only on any machine — no token needed, nothing is sent: cybermatic-discovery --list A device that never announces a name and has no DNS record shows as its MAC address. Open it and set a display name under Organizational metadata — a name you set always wins over anything discovery detects, and survives the device changing its address.
7. 7Step 6 — Optional: active identification (admin opt-in). Some devices reveal nothing on their own — a camera or controller with no name and no announcements. Active probing connects to a curated set of common ports to identify those by behaviour, which is how a camera, printer, or domain controller gets identified when it will not say so itself. This is off by default and only an administrator can turn it on, in Settings → Agents → Network discovery → Active identification. Turn it on knowingly: to security monitoring it looks like network scanning, so expect IDS/IPS alerts and whitelist the agent first. Two further tiers sit behind it — extended (hypervisor and management interfaces) and OT (BACnet, Modbus). Leave the OT tier off unless you understand your building-automation and industrial equipment: those controllers can be fragile, and unlike an IT device, disturbing one has physical consequences.
8. 8Troubleshooting. No devices appear — confirm the host is on the segment you mean (a VM behind NAT sees the hypervisor's private network, not your office LAN) and that the token has not been revoked. Fewer devices than your router lists — phones and tablets sleep their radios and answer intermittently; they fill in over subsequent reports. Devices your DNS server knows about are reported by name even while they are asleep. A device shows the wrong name — a name the device reports about itself always beats a DNS record, which can lag a lease change. If it is still wrong, set a display name on the device page; that overrides everything. Devices on other segments are missing — discovery does not cross routers by design. Install one agent per segment. See exactly what each technique found: cybermatic-discovery --once --verbose

Tip: Run cybermatic-discovery --list on a laptop first. It needs no token and sends nothing, so you can see exactly what the agent would report before you enroll anything.