Discovery & scanning
Argus works in two distinct phases, and it helps to keep them separate in your head:
- Discovery finds the datastores that exist in a cloud account - it lists your S3 buckets, RDS instances, and so on, and records each as an item in your inventory. It does not look inside them.
- Scanning looks inside a discovered datastore, samples its contents, and classifies the sensitive data it finds.
A datastore is always discovered first and scanned second. That is why a freshly connected account shows an inventory almost immediately, but classification results and risk scores appear only after the first scan completes.
What Argus discovers and scans
Section titled “What Argus discovers and scans”| Provider | Datastores |
|---|---|
| AWS | S3 buckets, RDS instances, DynamoDB tables, Redshift clusters |
| Azure | Blob containers, SQL databases, Cosmos DB, Synapse pools (where enabled) |
AWS also runs IAM discovery - a separate read-only sweep of your users, roles, groups, and policies that powers identity risk. Object stores (S3, Blob) and DynamoDB are read with the agent’s own cloud role; database engines (RDS, Redshift, Azure SQL, Synapse) need their own connection credentials, and until you supply them a datastore sits in the Needs credentials state.
The lifecycle of a datastore
Section titled “The lifecycle of a datastore”Every datastore carries a status that tells you where it is in the pipeline:
| Status | Meaning |
|---|---|
| Discovered | Found in the account, not yet scanned. |
| Needs credentials | A database engine that needs connection details before it can be scanned. |
| Scanning | A scan is in progress. |
| Ready | Scanned; classification and risk are current. |
| Error | The last scan failed. See the datastore detail for the reason. |
| Not found | Was present before, but absent from the latest discovery run - likely deleted. |
| Hidden | Manually hidden from active views (a deliberate choice, not a lifecycle state). |
Scheduling scans
Section titled “Scheduling scans”Discovery and scanning each run on their own recurring schedule, set per cloud account:
- Auto-discovery keeps the inventory current (defaults to every 12 hours).
- Auto-scan re-classifies contents (defaults to every 24 hours).
You can override either interval per account - choosing from a fixed set of intervals (6, 12, 24, 48, or 72 hours for scans) - or leave it on the tenant-wide default. You can also toggle either off entirely for an account, or trigger a run on demand. Scheduled scans always run a full scan; the lighter incremental mode (which re-checks only new and changed objects) is available on a manual run.
Scan depth is governed by a tenant scan intensity setting (low, medium, or high), which trades coverage against time and cost. How that depth is chosen per datastore is covered in Sampling & extrapolation.
When a datastore disappears
Section titled “When a datastore disappears”Cloud environments change, and Argus is deliberate about how it handles a datastore that vanishes so your metrics stay honest without losing history:
- When a discovery run no longer sees a previously known datastore, it is marked Not found and its prior status is remembered.
- A grace window (24 hours by default, adjustable per tenant) protects against a transient blip - a permissions hiccup or a discovery that partially failed. During the window nothing is torn down.
- After the grace window, Argus dismisses that datastore’s open alerts and policy violations, and excludes it from compliance, risk, and reporting totals - a deleted bucket should stop counting against your posture, and it must never be usable to quietly launder a bad score.
- If the datastore reappears in a later discovery, it is restored to its previous status and its dismissed alerts and violations are reactivated. Nothing is lost.
The same lifecycle applies to IAM identities that disappear. Not-found records are retained so history and reappearance both work, rather than being deleted on sight.
Under the hood: agents and jobs
Section titled “Under the hood: agents and jobs”Each discovery or scan is a job that the platform queues and one of your deployed agents claims and runs. A job moves through pending (queued), running (an agent is working it), and then completed or failed. Agents send heartbeats while they work; if an agent goes silent mid-job, or a job sits unclaimed with no healthy agent to run it, the platform reaps it and marks it failed with a reason, rather than leaving it stuck. You watch all of this from the Agents page - see Agents for the operational side, and Deploy the agent to add one.