Bundled Discovery Scripts in the Agent JAR

Discovery scripts used by the agent (PowerShell, batch, shell, and VBScript probes and sensors for Windows, Linux, and Unix) were previously shipped as separate plain files in a scripts folder next to the agent installation. The scripts could be opened, modified, or replaced by anyone with access to the host, leaving discovery logic outside the protection of the agent's code-signing. Verbose probe output was also being written to agent log files, cluttering them and making troubleshooting harder. All discovery scripts are now packaged inside the agent JAR and follow an extract-execute-delete pattern at scan time, with the temporary copy removed automatically after execution (including on failure). The previously installed loose scripts folder is removed automatically on upgrade, and unnecessary verbose log prints have been cleaned up.

Where the improvement appears

The new behavior is visible in the following locations:

Location	What changed
Agent installation folder on the endpoint	The loose scripts folder is no longer present. It is removed automatically on upgrade, and all probe and sensor scripts live inside the signed agent JAR.
Agent temp folder	Script files are written only for the duration of execution and are removed automatically after each scan, including on failure.
Agent log files	Unnecessary verbose log prints have been removed; only operational and error information remains.

Procedure

Complete the following step to apply the new agent-security improvements to existing endpoints.

1. Update the Discovery Agent.

   Deploy the updated agent to Windows, Linux, and Unix hosts to pick up the bundled, signed script set. Script extraction, execution, and cleanup happen automatically, and the old loose scripts folder on previously installed hosts is removed automatically on upgrade.

Note: No configuration changes are needed. No manual cleanup of the old scripts folder is required, and no changes to scan profiles or agent settings are needed.