I know of someone who ran nmap in combination with ansible to cause all hosts they had access to on the network to populate in foreman, but that requires that you have ssh access to all hosts. Another option if you know what systems are there is to use the new host registration feature in Foreman 2.3 - RFC: Simple & automatic host registration WF
