Discovery is the only way anything enters NHI Security’s inventory. You configure a connector, enable it, and it is synchronized, either when you ask or on a schedule. There is no screen or API that adds an identity by hand.

​
Connector states

State is what someone decided; health is what the last check observed. A connector can be enabled and unhealthy, and the console shows both. Creating, changing and synchronizing connectors needs the Organization Admin role, which TRUSTIVAN Owners and Admins receive. Any role can read connectors and run a health check.

​
Health checks

Check health on a connector’s page asks the provider whether the credentials are accepted and whether they are permitted to read. What it proves differs by provider:

​
Synchronization runs

Synchronize now runs a collection immediately, and the request waits until the run finishes. Only one run per connector can be in progress; a second request is refused until the first completes. Each run reports what it discovered, created, updated and left unchanged, the errors it met, and whether it read the whole scope. Every run across every connector is listed, newest first, under Integrations → Synchronizations, with whether it was manual or scheduled. Provider throttling, timeouts and outages are retried: up to three attempts per request, with growing, jittered delays, and a provider’s Retry-After is obeyed. Authentication and authorization failures are not retried, because repeating them cannot help and can lock a credential.

​
Findings after a synchronization

When a run ends succeeded or partially_failed, NHI Security runs policy evaluation for your organization straight after it, the same evaluation as Govern → Policies → Run evaluation. For a manual run, the request returns after evaluation finishes. A failure in evaluation is recorded as a failed evaluation run and does not undo the synchronization. A run that collected nothing does not trigger evaluation. See Findings and risk.

​
How NHI Security decides something is gone

Only a run that succeeded and read the whole scope may conclude that an identity no longer exists. When it does, identities from that connector that the run did not see move to decommissioned, and relationships it no longer returned are marked absent. Nothing is deleted. A partially_failed or failed run marks no identity or relationship as gone. Identities it did see are still updated to what the provider reported. A throttled sync therefore cannot make part of your estate disappear and then reappear on the next run. Two states are never changed by a synchronization: quarantined, which a person set, and decommissioned. An identity that reappears after being decommissioned stays decommissioned.

​
Scheduled discovery

NHI Security can synchronize enabled connectors without anyone asking. Whether it does is a deployment setting:
  • On by default in a production deployment, and off by default in local, demonstration and staging deployments. Your deployment operator can turn it on or off in either case.
  • By default each enabled connector is collected every 6 hours. The scheduler checks for due connectors every 5 minutes and starts at most 5 runs per check, so in a large deployment some connectors are collected later than their interval.
  • After a failed run, the connector is retried with a growing delay, from 5 minutes up to 6 hours.
  • A scheduled run collects exactly as a manual one does, triggers the same evaluation, and is recorded in the audit trail as scheduled.
Ask your deployment operator whether scheduled discovery is on for your deployment. When it is off, a connector only collects when someone chooses Synchronize now.