Techniques are disclosed relating to data discovery. A control program that is executing on a computer system may receiving a request to locate instances of data on a computer network having a plurality of computer systems that are managed by an orchestration program. The control program may perform multiple, limited-time-period deployments of a sniffer program to different portions of the computer network in order to sample network traffic from the different portions to determine whether instances of the data appear in the network traffic. The control program may receive, from the sniffer program, information that identifies one or more of the different portions of the computer network whose network traffic included instances of the data.