Strata Copilot
    Next-Gen Trust Security
    : Discovery Services
    Focus
    Focus
    1. Home
    2. Next‑Gen Trust Security
    3. Next-Gen Trust Security
    4. Next-Gen Trust Security Overview
    5. Discovery Overview
    6. Discovery Services

    Next-Gen Trust Security

    Discovery Services

    Table of Contents

    Discovery Services

    Discovery Services in Next-Gen Trust Security are essential tools for locating and managing digital certificates within your organization’s network and on public-facing servers. These services ensure that all certificates are accounted for, thereby reducing the risk of outages and security vulnerabilities.
    Note: Network Discovery is configured for the tenant as a whole, so the page appears only when Tenant is selected in the workspace switcher. Select any other workspace and it disappears from the menu and its URL stops resolving, which means discovery services cannot be created, edited, or run from inside a workspace. Users must have the appropriate Strata Cloud Manager (SCM) role permissions to manage discovery services, and Built-In Accounts must have them to perform API actions on Network Discovery configuration. Certificates that a discovery finds arrive unclaimed: they belong to no workspace until somebody claims them, and a user working inside a workspace can claim them there. See Workspace-Scoped Resources.

    Types of Discovery Services

    Because server certificates are used both within private networks and out on the Internet, discovering and managing them requires a secure and flexible approach called discovery services.
    Which discovery service you choose depends on your needs.
    Discovery ServiceUse to...Discovery Type
    Enhanced DiscoveryDiscover certificates inside of your company's network, similar to Basic Discovery, but uses Venafi VSatellite to run discoveries according to a fixed schedule (optional) and performs validation for you (after they are added to the certificates inventory). You can also run Enhanced Discovery with Run Now. See Discover private (internal) certificates.Internal
    Internet DiscoveryDiscover and protect certificates external to your company's private network. This service is created for you by default. But of course you can edit its name, add or remove targets, and change its discovery schedule. See Discover public (external) certificates.External
    Following certificate discovery, Next-Gen Trust Security adds all discovered certificates to the certificates inventory (Insights > Certificates). After the certificates are in the inventory, Next-Gen Trust Security can run daily validations on them and highlight potential issues that could cause outages.

    © 2026 Palo Alto Networks, Inc. All rights reserved.