Abstract: A computer program component configured to collect configuration item data from information technology resources of an air-gapped network for an information technology configuration management database is provided. Configuration item data collected from the information technology resources of the air-gapped network is obtained using the provided computer program component, wherein the obtained configuration item data is physically transferred between a device within the air-gapped network and a device outside the air-gapped network at least in part via a portable physical storage medium, and the collected configuration item data has been reviewed and filtered within the air-gapped network prior to being physically transferred via the portable physical storage medium. The obtained configuration item data is imported to the information technology configuration management database outside the air-gapped network.

Abstract: Example embodiments for identifying and displaying configuration item information are presented herein. A system may involve a proxy server application disposed within a managed network that includes configuration items and a server disposed within a remote network management platform managing the managed network. The server may receive a request to view information representative of a particular configuration item from a client device. Based on the request, the server may obtain the information and transmit a representation of a graphical user interface to the client device. The representation may include a health graphic, a relationship graphic, a timeline graphic, and an activity stream, each of which represent pertinent information about the particular configuration item. The representation may also include a tabbed interface that facilitates navigation between attributes corresponding to the particular configuration item and attributes corresponding to other configuration items in the managed network.

Abstract: Persistent storage may contain a list of discovery commands, the discovery commands respectively associated with lists of network addresses. A discovery validation application, when executed by one or more processors, may be configured to: read, from the persistent storage, the list of discovery commands and the lists of network addresses; for each discovery command in the list of discovery commands, transmit, by way of one or more proxy servers deployed external to the system, the discovery command to each network address in the respectively associated list of network addresses; receive, by way of the one or more proxy servers, discovery results respectively corresponding to each of the discovery commands that were transmitted, wherein the discovery results either indicate success or failure of the discovery commands; and write, to the persistent storage, the discovery results.

Abstract: A computing system may include a proxy server application and a database. The proxy server application may provide, to a computing device disposed within a managed network, instructions to identify one or more processes executing on the computing device. The proxy server application may also determine, for a process of the one or more processes, a file system path of a directory associated with the process and, based thereon, select one or more directories to scan for files associated with the process. The computing device may be provided with instructions to (i) scan the one or more directories and (ii) determine a plurality of attributes associated with one or more files discovered therein. The proxy server application may additionally receive results of the scan containing a representation of the plurality of attributes and store, in the database, the results of the scan.

Abstract: A discovery computing system may receive an account identifier (ID) and a set of credentials required to access a first service account. The discovery computing system may transmit a first API query to a remote computing system. The discovery computing system may receive an organization identifier (ID) of the organization from the remote computing system. The discovery computing system may further transmit a second API query to the remote computing system. The discovery computing system may be further configured to receive information about a set of projects, in the organization, from the remote computing system. The discovery computing system may further generate a set of service accounts and further determine the set of resources, in the remote computing system, associated with each of the generated set of service accounts. The discovery computing system may further store the determined set of resources, as configuration items in a persistent storage.

Abstract: A computer program component configured to collect configuration item data from information technology resources of an air-gapped network for an information technology configuration management database is provided. Configuration item data collected from the information technology resources of the air-gapped network is obtained using the provided computer program component, wherein the obtained configuration item data is physically transferred between a device within the air-gapped network and a device outside the air-gapped network at least in part via a portable physical storage medium, and the collected configuration item data has been reviewed and filtered within the air-gapped network prior to being physically transferred via the portable physical storage medium. The obtained configuration item data is imported to the information technology configuration management database outside the air-gapped network.

Abstract: Embodiments presented herein provide apparatus and techniques for identifying and classifying processes and associated applications executing in a network. All processes executing in a network may be identified using a discovery process. The processes may be clustered based on associations between the processes. Suggested application entries may then be generated based at least in part on the clusters of processes. A configuration item type and a discovery pattern may be generated for each suggested application entry. A subsequent discovery process may use the configuration item type and discovery patterns to identify associated configuration items in the network.

Abstract: A system may include a computational instance disposed within a remote network management platform and associated with a managed network, where the computational instance contains a configuration management database. The system may also include a software application disposed on a server device of the managed network and configured to perform operations comprising: obtaining, from the configuration management database, a list of directories, a list of file types, and a list of file names; remotely accessing a computing device of the managed network; for each respective directory in the list of directories, obtaining, from the computing device, information respectively related to discovered files that are: (i) disposed within the respective directory on the computing device, and (ii) specified by the list of file types or specified in the list of file names; and transmitting, to the configuration management database, the information related to the discovered files.

Abstract: A non-transitory computer readable storage medium may have stored thereon instructions that, when executed by an endpoint device, cause the endpoint device to perform operations including: (i) establishing, by the endpoint device, a first communication channel with an intermediary proxy server; (ii) receiving, from a computational instance and via the intermediary proxy server, a registration payload comprising a list of available proxy servers; (iii) ranking, at the endpoint device, the list of available proxy servers; (iv) selecting, by the endpoint device, a particular proxy server from the list of available proxy servers as ranked; (v) establishing, by the endpoint device, a second communication channel with the particular proxy server; and (vi) communicating, by the endpoint device, with the computational instance via the particular proxy server by utilizing the second communication channel.

Abstract: A non-transitory computer readable storage medium may have stored thereon instructions that, when executed by an endpoint device, cause the endpoint device to perform operations including: (i) establishing, by the endpoint device, a first communication channel with an intermediary proxy server; (ii) receiving, from a computational instance and via the intermediary proxy server, a registration payload comprising a list of available proxy servers; (iii) ranking, at the endpoint device, the list of available proxy servers; (iv) selecting, by the endpoint device, a particular proxy server from the list of available proxy servers as ranked; (v) establishing, by the endpoint device, a second communication channel with the particular proxy server; and (vi) communicating, by the endpoint device, with the computational instance via the particular proxy server by utilizing the second communication channel.

Abstract: An example computing system includes a database disposed within a remote network management platform associated with a managed network that obtains service from a computing cluster that includes one or more worker nodes configured to execute containerized software applications using a containerized orchestration engine. The computing system also includes a computing device configured to identify a namespace associated with the containerized orchestration engine. The computing device is also configured to query a deployment configuration application programming interface (API) associated with a containerized application platform to obtain deployment configuration data. Further, the computing device is configured to query a build configuration API associated with the containerized application platform to obtain build configuration data.

Abstract: Persistent storage may contain software models defining corresponding software packages and entitlements to a software package, wherein use of the entitlements is constrained by entitlement rules. One or more processors may be configured to: (i) determine, by querying computing devices, a first deployment of the software package; (ii) determine, by querying an interface of a public cloud platform, a second deployment of the software package, wherein use of the entitlements on the public cloud platform is constrained by platform rules; (iii) determine, based on the constraints, an assignment of the entitlements to the first deployment and the second deployment; (iv) determine that the assignment leaves one or more deployed instances of the software package not covered by the entitlements; and (v) determine a modification to the entitlements that: satisfies the constraints and facilitates a further assignment of the entitlements that covers all deployed instances of the software package.

Abstract: Persistent storage may include a configuration management database (CMDB), the CMDB representing devices and software applications disposed within a managed network and relationships therebetween. A proxy server may be configured to relay discovery information between a plurality of endpoint devices associated with the managed network and the CMDB, wherein respective discovery agents are disposed within each of the endpoint devices, and wherein the proxy server contains one or more processors configured to execute program instructions that perform operations including: (i) receiving, from a discovery agent disposed within an endpoint device, a discovery payload, wherein the discovery payload includes: a configuration of the endpoint device and information regarding one or more software applications installed on the endpoint device, and wherein the proxy server did not request the discovery payload; and (ii) transmitting, by the proxy server, the discovery payload to the CMDB.

Abstract: Persistent storage may include a configuration management database (CMDB), the CMDB representing devices and software applications disposed within a managed network and relationships therebetween. A proxy server may be configured to relay discovery information between a plurality of endpoint devices associated with the managed network and the CMDB, wherein respective discovery agents are disposed within each of the endpoint devices, and wherein the proxy server contains one or more processors configured to execute program instructions that perform operations including: (i) receiving, from a discovery agent disposed within an endpoint device, a discovery payload, wherein the discovery payload includes: a configuration of the endpoint device and information regarding one or more software applications installed on the endpoint device, and wherein the proxy server did not request the discovery payload; and (ii) transmitting, by the proxy server, the discovery payload to the CMDB.

Abstract: A discovery computing system may receive an account identifier (ID) and a set of credentials required to access a first service account. The discovery computing system may transmit a first API query to a remote computing system. The discovery computing system may receive an organization identifier (ID) of the organization from the remote computing system. The discovery computing system may further transmit a second API query to the remote computing system. The discovery computing system may be further configured to receive information about a set of projects, in the organization, from the remote computing system. The discovery computing system may further generate a set of service accounts and further determine the set of resources, in the remote computing system, associated with each of the generated set of service accounts. The discovery computing system may further store the determined set of resources, as configuration items in a persistent storage.

Abstract: Embodiments presented herein provide apparatus and techniques for identifying and classifying processes and associated applications executing in a network. All processes executing in a network may be identified using a discovery process. The processes may be clustered based on associations between the processes. Suggested application entries may then be generated based at least in part on the clusters of processes. A configuration item type and a discovery pattern may be generated for each suggested application entry. A subsequent discovery process may use the configuration item type and discovery patterns to identify associated configuration items in the network.

Abstract: A system may involve persistent storage containing a configuration management database (CMDB) and a non-CMDB table, wherein the CMDB contains configuration items that represent software, devices, or services deployed within a network, and wherein the non-CMDB table contains entries related to operation of the network. The system may also involve one or more processors configured to provide a representation of a graphical user interface (GUI), wherein the GUI contains a first selectable tab that displays classes of the configuration items, a second selectable tab that displays the non-CMDB table, and a canvas for visually depicting query expressions, wherein the classes are selectable to place class GUI elements thereof onto the canvas, wherein the non-CMDB table is selectable to place a table GUI element thereof onto the canvas, and wherein the table GUI element and a particular class GUI element are connectable by a link on the canvas.

Abstract: An example embodiment may be performed by a software application executable on a computing device and may involve communicating with a server to access records of sessions between the server and computing devices of a managed network. The managed network may contain the server and a database associated with licensed software executable on the server. The database may store the records, and the records may include network addresses of the computing devices. The example embodiment may also involve: using a set of license misuse criteria to identify, within the records, (i) a set of the sessions that meets the set of criteria and (ii) a network address of a target device involved in the set of sessions; based on the network address of the target device, identifying the target device; and storing in memory an indication identifying the target device as a potential source of misuse of the licensed software.

Abstract: Example embodiments for identifying and displaying configuration item information are presented herein. A system may involve a proxy server application disposed within a managed network that includes configuration items and a server disposed within a remote network management platform managing the managed network. The server may receive a request to view information representative of a particular configuration item from a client device. Based on the request, the server may obtain the information and transmit a representation of a graphical user interface to the client device. The representation may include a health graphic, a relationship graphic, a timeline graphic, and an activity stream, each of which represent pertinent information about the particular configuration item. The representation may also include a tabbed interface that facilitates navigation between attributes corresponding to the particular configuration item and attributes corresponding to other configuration items in the managed network.

Abstract: A computing system may include a proxy server application and a database. The proxy server application may provide, to a computing device disposed within a managed network, instructions to identify one or more processes executing on the computing device. The proxy server application may also determine, for a process of the one or more processes, a file system path of a directory associated with the process and, based thereon, select one or more directories to scan for files associated with the process. The computing device may be provided with instructions to (i) scan the one or more directories and (ii) determine a plurality of attributes associated with one or more files discovered therein. The proxy server application may additionally receive results of the scan containing a representation of the plurality of attributes and store, in the database, the results of the scan.