Overview of Agent Discovery
Find your Shadow AI Agents in your organization
You can't govern AI agents you don't know about. Most organizations already have more agents running than anyone has accounted for: agents deployed on cloud AI platforms, agents that teams built and never registered, and agentic tools on employee laptops that have shell, filesystem, or browser access. Agent Discovery finds these agents by scanning your environment, adds them to one inventory, and gives each one a place in Arthur where it can be monitored and governed.
What it finds
Discovery connects to systems you already run and reads what they already know:
| What Arthur scans | Sources | What Arthur sees |
|---|---|---|
| Cloud AI platforms | GCP Vertex, AWS Bedrock AgentCore, Azure AIFoundry, and others | Every agent deployed in a project and region |
| Employee endpoints | Jamf Pro, Crowdstrike, Microsoft Defender, and others | Agentic coding tools, autonomous local agents, AI browsers and extensions, etc. |
| Security telemetry | Splunk Enterprise, Elastic Security, Microsoft Sentinel, and others | Agents that show up in the logs and events your SIEM already collects, found with your own SPL or ES|QL queries |
| Network and Gateway logs | AWS Cloudwatch, GCP CloudLog, network logs, LiteLLM, Kong, and others | Requests made to GenAI providers, either LLM calls or other agentic traffic |
| Arthur's Evaluation Engine OTEL Sink | Forwarded OTEL traffic from AI-native applications | Every application sending traces to your Arthur Engine |
Discovery reads from these systems and never changes them. Each source only needs permission to list or search, and the credentials you give it are kept out of every log and error message.
Why it matters
- One inventory for every agent. Each discovered agent becomes a task in Arthur, alongside the applications you already monitor. You can see which agents are registered and governed and which are not, so the gaps are easy to spot.
- Stable identity, no duplicates. The same agent maps to the same task on every scan. If a team later adds tracing to an agent that was first found by discovery, its traces arrive on that existing task. Nothing has to be merged or cleaned up.
- Evidence you can act on. Each agent records which source found it, where it runs, and when it was last seen, so you can follow up with the team that owns it.e
- Coverage that keeps up. Scans run on a schedule, so new agents show up without anyone filing a request. For endpoints, Arthur matches agents against its catalog on the server. When a new kind of agent is added to the catalog, Arthur checks it against evidence it already holds and tells you which machines have it, without scanning the fleet again.
- Failures you can see. Every scan reports whether it succeeded and why it failed if it didn't (for example, bad credentials or a missing permission), so a source that stops working gets noticed.
How you can run it
With the Arthur Platform. Add a discovery source in the Platform, use Test Connection to check the credentials and preview what the source returns, and the Arthur Engine in your environment runs the scans. Discovered agents appear in your Arthur inventory, ready for policies, monitoring, and guardrails.
Standalone, into your SIEM. If you want an AI inventory before you adopt the full platform, the ML Engine can run on its own as a single container. It scans the sources named in a config file on an interval and sends each discovered agent to Splunk HTTP Event Collector or any HTTPS webhook. It doesn't need the Arthur Platform or the GenAI Engine. See Standalone Agent Discovery for setup.
In both modes, the scans run inside your own environment.
Updated 8 minutes ago