CMDB and discovery

Discovery builds one trustworthy inventory of your assets from many sources. It sweeps directory, cloud, and network sources, normalizes what it finds, and merges duplicates across sources by identity, taking the strongest signal first (machine UUID, then serial, hostname, MAC, IP, and name for machines, and email for people). The merged assets are classified and synced to your CMDB as configuration items, and those items link to each other through typed, confidence-scored edges. That graph is what services and dependency views are built on.

When you’d use it

• Know what you own by pulling assets from directory, cloud, and network sources into one place.
• Keep the inventory clean by merging the same machine or person seen in several sources.
• Map dependencies so you can see what a service relies on and what a change would affect.
• Feed other work such as service definitions and software licensing from one canonical source.

What you manage

Discovery and the CMDB live under Assets & Discovery, in its Configure and Explore groups. What you configure:

• Sources (/discovery/sources). The directories, cloud accounts, and scanners to sweep, and what each sweep collects and how often.
• Classification (/discovery/classification). The rules that tag an asset’s type.
• Inventory and dependencies (/cmdb/inventory, /discovery/dependencies). The resulting configuration items and their links.

Configure a source in the admin guides; store the credentials a source needs in Credentials and secrets.

Good to know

• Merging works from identity, not a fingerprint. A weak-identity merge (say on MAC or IP alone) is flagged as ambiguous for your review rather than merged quietly, and junk hardware ids and virtual or locally-administered MACs are skipped.
• No single source is treated as complete. The inventory is a merge across sources, with an honest flag when identity is weak.
• Classification runs immediately with built-in fingerprints and your per-source rules; an optional model-assisted tier runs in the background.

Software asset management

Once discovery gives you a clean inventory and usage signals, it can also tell you whether you are within your software licenses. You describe how each license is counted, record what you are entitled to, and reconciliation compares consumption against entitlement to produce a compliance position: compliant, over-deployed, under-utilized, expiring, or unmeasurable. When a license genuinely cannot be measured, it reports “unmeasurable” with the reason rather than a false zero that would understate your risk. This lives under Assets & Discovery → Explore → Software Assets (/sam).

From an assistant

An AI client connected over MCP (see Connect via MCP) can list, read, and validate your discovery sources: list_discovery_sources, get_discovery_source, and try_discovery_source run immediately. Creating or changing a source always waits for a person to approve it, because a discovery source is itself a connection to something outside the platform, the same as a real person clicking Save on this page would expect a reviewer to see before it goes live. No tool call accepts a password, API key, or other secret inline; point it at a credential you already created on the Credentials page instead.

Setup, credential sets, agent pools, classification rules, and Insights data sources are not reachable over MCP at all today. Configure those through their own pages.

How it connects

Discovery owns collection and deduplication, classification owns tagging, and the CMDB owns the configuration items and their edges. Mapping a service to the items that support it is computed over the CMDB graph by the service-definitions layer. Software licensing reads usage signals from the same inventory.

• Configure a discovery source and profile in the admin guides.
• Exact shapes: tables fl_discovery_sources, fl_discovery_assets, fl_cmdb_items (the configuration-item register), and fl_cmdb_edges; every term in the glossary.