What Is This System?

AOS Discover is your asset discovery and security monitoring dashboard. It automatically finds all IT assets in your organization—like servers, databases, cloud services, and software applications—then categorizes them by security risk level.

Understanding The Triage Center

The Triage Center shows you assets that need your attention, organized into 4 risk-based queues:

What Actions Can I Take?

Standard Actions (available for all asset types):

Shadow IT-Specific Actions:

Data Conflict Actions:

How Do Assets Move Through The System?

• Discovered: New assets start in "DISCOVERED" state. Most pass through automatically to the catalog.
• Parked: Assets flagged for triage (anomalous or shadow IT suspected) are moved to "PARKED" state and appear in triage queues based on their risk level
• Cataloged: When you click "Approve & Onboard", assets move to "CATALOGED" state (approved inventory) and leave the triage queue
• Resolved: Any triage action you take moves assets to CATALOGED and removes them from the queue

Best Practices

• Start with HIGH RISK: Always tackle critical security threats first—these are potential active compromises
• Use View Logs: Check the detailed logs before making decisions, especially for HIGH RISK assets
• Shadow IT needs context: Don't just block unauthorized tools—understand why people are using them. Often it reveals gaps in your approved toolset
• Block requires quarantine: This two-step process ensures you've properly reviewed an asset before permanent blocking
• All actions are logged: Every decision you make is recorded in the audit trail for compliance and review

Need Help?

If you encounter issues or need assistance, contact your IT security team or system administrator.

What Is the Training Center?

The Training Center is where you manage the AI system that powers asset discovery. Think of it as the "brain" of AOS Discover—it learns patterns from data to help identify and classify IT assets automatically.

Understanding System Metrics

System Health: Shows if the system is running properly—API status, how long it's been up, and how much computer resources it's using.

Data Summary: How many assets the system has processed and how many were flagged as Shadow IT (unauthorized software).

What Can I Do Here?

Training Controls (Developer Mode)

Toggle "Vendor Mode" to see advanced controls. These are for system administrators only:

Training Mode:

• Fresh: Train from scratch (recommended when changing settings)
• Incremental: Build on previous training (faster but may carry over old patterns)
• Synthetic Only: Train only on test data
• Cached: Use previously saved training

Assets Scale: Controls how much test data to generate. Higher numbers (2.0x, 3.0x) create more training data but take longer. Use 1.0x for normal operations.

Contamination Rate: How sensitive the system is to detecting Shadow IT. Higher = flags more items as suspicious.

Discovery Mode:

• Hybrid: (Recommended) Uses both AI and rules—most accurate
• Rules: Only uses pre-programmed rules—faster but less intelligent
• ML: Only uses AI—most intelligent but may make mistakes

When Should I Retrain?

• When the system is flagging too many false positives (legitimate assets marked as threats)
• After making changes to training settings
• Periodically (monthly) to keep the AI current with your environment
• After major IT infrastructure changes in your organization

Best Practices

• Use Hybrid mode: It combines the best of both AI and rules
• Don't retrain too often: Once a month is usually enough unless you have specific issues
• Watch the metrics: If F1 scores are dropping over time, it may be time to retrain
• Save your settings: Always click "Save Settings" after making changes

What Is Experiment History?

Experiment History tracks every time you've trained the AI system. It shows you how well the system performed each time, so you can see if it's getting better, worse, or staying consistent.

Understanding the Metrics

F1 Score: The overall accuracy measure. Think of it as a "grade" for how well the AI performs:

• 90-100% = Excellent (A grade)
• 80-89% = Good (B grade)
• 70-79% = Acceptable (C grade)
• Below 70% = Needs improvement

Precision: When the system says "this is Shadow IT," how often is it right? Higher is better—means fewer false alarms.

Recall: Of all the actual Shadow IT out there, how much does the system catch? Higher means it's finding more threats, but might include some false positives.

Reading the Chart

The F1 Score Trend chart shows performance over time. You want this line to:

• Stay flat and high: System is consistently accurate
• Trend upward: System is learning and improving
• Trend downward: Performance is degrading—may need to adjust training settings or retrain

What Do the Experiment Details Tell Me?

Timestamp: When the training happened

Mode: How it was trained (Fresh, Incremental, Synthetic Only, or Cached)

Training Details: How much data was used. More samples generally means better training, but takes longer.

Status: ✓ Complete means the training finished successfully

What Should I Look For?

Best Practices

• Check after each training: Always review experiment results after retraining to ensure quality didn't drop
• Compare to previous runs: Look for trends, not just individual scores
• Keep successful configurations: Note what settings produced the best F1 scores
• Document changes: If you change training settings, note what you changed so you can track impact

Troubleshooting

"No experiments yet": Run training from the Training Center first—click "Retrain"

All scores are low: The system may need more training data. Try increasing Assets Scale to 2.0x or 3.0x in Training Center.

Scores vary wildly: This suggests inconsistent training data. Use "Fresh" mode and consistent settings for more stable results.