Click to expand the code block
``` @@ -106,7 +107,7 @@ Variables are used to define the file name. We use the computer name and the dat ```-When creating a certificate autodiscovery job, enter an IP address or range of IP addresses and the ports to scan. Device42 will import discovered certificates. A certificate discovered on an IP address already associated with a device in Device42 will automatically be associated with that device. +When creating a certificate autodiscovery job, enter an IP address or range of IP addresses and the ports to scan. Device42 will import discovered certificates. Certificates discovered on IP addresses already linked to devices will automatically be associated with those devices.
### SSL Certificate Cipher Suite Discovery -Device42 can discover SSL cipher suites as part of certificate autodiscovery. If you'd like to discover cipher suites, check the **Find cipher suites supported by the server** checkbox. +To discover SSL cipher suites as part of certificate autodiscovery, select the **Find cipher suites supported by the server** checkbox.
-Add your Cisco UCS Manager or ACI Fabric discovery job by entering one or more IPs or FQDNs, and scroll down to enter your username and password (with permissions) on the device. +Add your Cisco UCS Manager or ACI Fabric discovery job by entering one or more IPs or FQDNs. Enter credentials for an account with appropriate permissions.
- -### **Scheduling UCS Cluster or ACI Fabric Discovery Jobs** - -Schedule your autodiscovery job to run regularly on certain days and at specific times. - -
-From the job create and edit modes, you can set one or more schedules for the job by clicking **+ Add another Autodiscovery Schedule**. +## Schedule the Discovery Job + +When creating or editing a job, you can set one or more schedules by clicking **+ Add another Autodiscovery Schedule**.
Click to expand code example
- ```js + ```json { "Version": "2012-10-17", "Statement": [ @@ -235,18 +319,9 @@ Note that some Discovery items require enabling the feature and cannot be discov ```
+
-**From the Main Account:**
-
- - Create a role within IAM using the **Another AWS Account** option.
-
- - Supply an account that uses **Account ID** and an account that uses the **Require External ID** option. There isn't a requirement for MFA option at this time.
-
- - Use the [example IAM policy](#additional-endpoint-information) needed for discovery.
-
-**From the sub- (or separate) account:**
+**Option 3: Role Assumption Using Dynamic Account Discovery**
-Assign a user to a role that has already been granted access as described in [Grant Access to the Role](https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_cross-account-with-roles.html#tutorial_cross-account-with-roles-2).
+This option is good if you want to discover resources in all member accounts without specifying individual Account IDs.
-### Setting Up Dynamic Account Discovery Roles
+:::note
+This requires the associated Remote Collector or Main Appliance to be deployed within the organization's root (management) account. See [Setting Up Dynamic Account Discovery Roles](#setting-up-cross-account-role-assumption) for more details.
+:::
-You can discover all sub-accounts and add them to the discovery process using Dynamic Account Discovery.
+Example IAM Policy
-The following steps are required if you are looking to leverage the AWS switch (Assume) Role on the API calls to scan other AWS accounts +```json +{ + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": [ + "sts:assumerole" + ], + "Resource": [ + "*" + ] + } + ] +} +``` +
+
-**Option 1:**
+When you've confirmed you have the appropriate permission set selected, click **Next**, give the policy a name and description, and click **Create Policy**.
-- The key pair user must be deployed into the organization’s root account.
-- This user's policy must have the following rights, at minimum:
- - `sts:assumerole`
- - `organizations:listaccounts`
-- A role must be added to all accounts where discovery is desired, with the same role name used in every account where discovery is desired.
-- The Device42 discovery policy must be granted to the role.
-- For role config within Device42, do not add any accounts to the role.
-- At this time, we cannot use dynamic account discovery to discover roles that use external ID values.
+### Step 3: Create a New IAM Role
-**Option 2:**
+1. On the IAM Role creation screen, select **AWS service** as the trusted entity type and **EC2** as the service or use case. Click **Next**.
+2. On the add permissions screen, search for and select the policy created in Step 2. Click **Next**, give the role a name and description, and then click **Create Role**.
-If you don't want to follow the steps above, you can either:
- - Make the assumable role available in the main account. Dynamic discovery will pull it in if no accounts are listed, or if the main account is included in the manually added list of IDs.
- - Or also attach the Device42 discovery policy to the user directly. Select the **Discover main account** box on the job.
+If you want to do the role preparation via the AWS CLI instead of the AWS Management Console, you can reference the trust policy below:
-## Using AWS Roles To Discover Accounts Within Discovery Jobs
+Example IAM Policy
-There are prerequisite steps we'll cover before getting into how to setting up the roles: -1. Create a role with no accounts associated with it. -2. Use the role in the discovery with the key pair associated with it. +```json +{ + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": [ + "sts:assumerole", + "organizations:listaccounts" + ], + "Resource": [ + "*" + ] + } + ] +} +``` +
+
-## Cloud Instance Statuses
+### Step 4: Attach the Role
-All VMs in Device42 have their statuses normalized into one of three buckets: **Running**, **Stopped**, or **Deleted**. This allows for consistency regardless of which hypervisor or cloud is used.
+1. From the EC2 Instances list page, select the EC2 instance deployed in Step 1. Then click **Actions > Security > Modify IAM role**.
+2. From the "Modify IAM role" page, select the IAM Role created in Step 3 and click **Update IAM role**.
-Device42's statuses aren't mapped to the naming convention of the cloud provider. For example, [in AWS](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-lifecycle.html), VM states include **Running**, **Stopped**, and **Terminated**. In Device42, the **Terminated** state is mapped to **Deleted**.
+### Step 5: Additional Configuration for Multi-Account Role Assumption
-## Setting Up Environment Credentials using EC2 Instance Profiles
+If you're configuring Single Account Discovery, no further steps are needed. If you've opted for Role Assumption using static or dynamic account discovery, continue with the steps below.
-You can perform AWS discovery without supplying any form of long-term, programmatic credentials by leveraging Instance Profiles or IAM roles for Amazon EC2 instances.
+1. **Create the discovery policy** in each member account to be discovered. Follow Step 2 again, but this time, use the [example discovery policy](#iam-policy-and-endpoints).
-When **Use Environment Credentials** is enabled, the discovery job can be saved without selecting an Access Key ID or Secret Key in the job configuration. This is only possible when using an AWS-hosted Main Appliance or Remote Collector for discovery as it relies on internal AWS mechanisms.
+2. **Create the discovery role** in each member account to be discovered. Follow Step 3 again, but this time, select **Custom trust policy** instead of **AWS service**. Paste the trust policy below, then at the add permissions screen, search for and select the discovery policy created in the previous step.
-Example Trust Policy
-AWS Cloud Discovery Jobs can use AWS roles to discover accounts. When the job includes the AWS role, the discovery job will dynamically grab multiple accounts from AWS. We previously aimed to maintain a 1:1 relationship between roles and accounts. Now, a single role can discover multiple accounts. This enables AWS users to set up discovery and specify the precise account to create, or leave the account empty to have the discovery job create cloud accounts as a result of the discovery. +```json +{ + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": [ + "sts:AssumeRole" + ], + "Principal": { + "Service": [ + "ec2.amazonaws.com" + ] + } + } + ] +} +``` +
+
+
+ Replace the placeholder values with your own:
+ - `ROOT_ACCOUNT_ID` — The root account ID where the role configured in Step 3 resides.
+ - `EC2_D42_RC_ROLE` — The name of the role in the root account to establish trust with.
+
+## Cloud Instance Statuses
+
+All VMs in Device42 have their statuses normalized into one of three buckets: **Running**, **Stopped**, or **Deleted**. This allows for consistency regardless of which hypervisor or cloud is used.
+
+Device42's statuses aren't mapped to the naming convention of the cloud provider. For example, [in AWS](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-lifecycle.html), VM states include **Running**, **Stopped**, and **Terminated**. In Device42, the **Terminated** state is mapped to **Deleted**.
\ No newline at end of file
diff --git a/docs/auto-discovery/cloud-auto-discovery/azure-autodiscovery.mdx b/docs/auto-discovery/cloud-auto-discovery/azure-autodiscovery.mdx
index de5a83c17..75eb12cf1 100644
--- a/docs/auto-discovery/cloud-auto-discovery/azure-autodiscovery.mdx
+++ b/docs/auto-discovery/cloud-auto-discovery/azure-autodiscovery.mdx
@@ -7,34 +7,37 @@ import ThemedImage from '@theme/ThemedImage'
import useBaseUrl from '@docusaurus/useBaseUrl'
import azureTagsImg from '/assets/images/azure-autodiscovery/azure-tags.png'
-Device42 provides insights into your Azure resources and services by using an application service principal in accordance with [Microsoft’s security recommendations](https://learn.microsoft.com/en-us/azure/active-directory/develop/secure-least-privileged-access).
+Device42 Azure discovery provides visibility into your Azure resources and services, including virtual machines, databases, storage, networking, Kubernetes clusters, and more. Discovery uses an application service principal in accordance with [Microsoft's security recommendations](https://learn.microsoft.com/en-us/azure/active-directory/develop/secure-least-privileged-access).
-This page walks you through the process of creating an application service principal with limited permissions to enable a quick and easy inventory of Azure resources using Device42.
+This page walks you through creating an application service principal with limited permissions, configuring role-based access, and setting up an Azure discovery job in Device42.
## Get Started with Azure
-Before you begin discovery in Device42, prepare your Azure environment. Ensure you've followed the two preparatory steps in your Azure account before you attempt discovery.
+Before you begin discovery in Device42, prepare your Azure environment. Complete the following two preparatory steps in your Azure account before you attempt discovery.
-### Application Preparation
+### Prepare the Application
-First, log in to Azure via [https://portal.azure.com](https://portal.azure.com), then navigate to **Azure Active Directory > Enterprise Applications > New Application > Create Your Own Application**. Name your application and select the **Integrate any other application you don’t find in the gallery (Non-gallery)** option.
+1. Log in to Azure via [https://portal.azure.com](https://portal.azure.com).
+2. Navigate to **Azure Active Directory > Enterprise Applications > New Application > Create Your Own Application**.
+3. Name your application and select the **Integrate any other application you don't find in the gallery (Non-gallery)** option.
+4. Navigate back to the top-level directory you created the app in and choose **App Registrations**.
+5. Select your newly created app and note the **Application (client) ID** and the **Directory (tenant) ID**, as both are used for Device42 discovery.
+6. Select **Certificates & Secrets**, then **New Client Secret**.
+7. Give your secret an optional description and an expiration date, then select **Add**.
+8. Note the string in the **Value** column. This is used as the **Client Secret ID** for Device42 discovery and will not be visible again once you sign out of the Azure portal.
-Once your application has been created, navigate back to the top-level directory you created the app in and choose **App Registrations**. Select your newly created app and make note of the **Application (client) ID** and the **Directory (tenant) ID** as these will both be used for Device42 discovery.
+### Prepare the Role
-Select **Certificates & Secrets**, then **New Client Secret**. Give your secret an optional description and an expiration date. Then, select **Add**. Take note of the string in the **Value** column, as it will be used as the **Client Secret ID** for Device42 discovery, and it will not be visible again once you have signed out of the Azure portal.
+Device42 lets you discover Azure resources at the tenant or subscription level. Tenant discovery is best suited to environments with large numbers of Azure subscriptions. If you only have a few Azure subscriptions, subscription discovery may be preferable.
-### Role Preparation
-
-Device42 lets you discover Azure resources by tenant or subscription level. Tenant discovery is best suited to customers with large numbers of Azure subscriptions. If you only have a few Azure Subscriptions, you may find subscription discovery preferable.
-
-Please note that the assignable scope in the policy below assumes you are performing subscription-level discovery.
+The assignable scope in the policy below assumes you are performing subscription-level discovery.
If you are performing tenant-level discovery, be sure to change the assignable scope to:
`/providers/Microsoft.Management/managementGroups/root-management-group-id-goes-here`
#### Subscription Level
-The next step is to create a role with limited permissions that will be applied to this application. If you haven't set up your roles yet, see the [Microsoft Assign Azure roles](https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal?tabs=delegate-condition) page. The role lets Device42 use the application for discovery purposes, while adhering to the principle of least privilege.
+The next step is to create a role with limited permissions that will be applied to this application. If you haven't set up your roles yet, see the [Microsoft Assign Azure roles](https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal?tabs=delegate-condition) page. The role lets Device42 use the application for discovery purposes while adhering to the principle of least privilege.
Navigate to the **Subscriptions** section in the Azure portal and select the subscription you would like to allow this application to discover. Take note of the **Subscription ID**, as it will be used later for Device42 discovery.
@@ -44,8 +47,8 @@ The **Discover all subscriptions** option should be unchecked to enable subscrip
Navigate to **Subscriptions > Select your Subscription > Access Control (IAM) > Roles > Add > Add Custom Role**. Give the custom role a name, and an optional description, then select either **Start from scratch** or **Start from JSON**.
-1. If using the **Start from scratch** option, you need to manually select each permission needed for this application to access the desired resources. The permissions needed are available in the Device42 [cloud autodiscovery](auto-discovery/cloud-auto-discovery/index.mdx) documentation. Select **Add permissions**, search for and select the desired permission, check the relevant box, and choose **Add**. Repeat this for any desired permissions.
-2. If using the **Start from JSON** option, copy and paste the JSON data below, to pull in the necessary permissions from the list in the Discovery section, and save it as a `.json` file. Upload this file on the **Basics** page when creating the role, and the permissions will be automatically defined.
+1. If using the **Start from scratch** option, manually select each permission needed for this application to access the desired resources. The permissions needed are available in the Device42 [cloud discovery](index.mdx) documentation. Select **Add permissions**, search for and select the desired permission, check the relevant box, and choose **Add**. Repeat this for any desired permissions.
+2. If using the **Start from JSON** option, copy and paste the JSON data below to pull in the necessary permissions from the list in the Discovery section and save it as a `.json` file. Upload this file on the **Basics** page when creating the role, and the permissions will be automatically defined.
Example Trust Policy
-### Configuration - -1. **Deploy a Main Appliance or Remote Collector within AWS.** -2. **Create a new IAM Policy:** - - On the IAM Policy creation screen, click **JSON** in the policy editor and copy paste one of the policies below based on your desired discovery configuration: - - Option 1: For single account Discovery, refer to the example discovery policy above. - - - Option 2: Role Assumption Using Static Account Discovery - - This option is good if you have a need to specify External IDs when assuming roles, as Dynamic Account Discovery does not support role assumption using External IDs. - - *Example IAM Policy* - -
-
-
- - Option 3: Role Assumption Using Dynamic Account Discovery
-
- This option is good if you want to discover resources in all member accounts without the need to specify individual Account IDs.
-
- **Note:** This requires the associated Remote Collector or Main Appliance to be deployed within the organization's root (management) account.
-
- See: [Setting Up Dynamic Account Discovery Roles](#setting-up-dynamic-account-discovery-roles) for more details on configuring Dynamic Account Discovery.
-
- *Example IAM Policy*
-
- Click to expand code example
- - ```js - { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Action": [ - "sts:assumerole" - ], - "Resource": [ - "*" - ] - } - ] - } - ``` -
-
-
- When you've confirmed you have the appropriate permission set selected, click **Next**, give the policy a name and description, and click **Create Policy**.
-
-3. **Create a new IAM Role**
-
- - On the IAM Role creation screen, select **AWS service** as the trusted entity type and **EC2** as the service or use case. Click **Next**.
- - On the add permissions screen, search for and select the policy created in Step 2. Click **Next**, give the role a name and description, and then click **Create Role**.
-
- If you want to do the role preparation via the AWS CLI and not within the AWS Management Console, you can reference the trust policy below:
-
- *Example Trust Policy*
- Click to expand code example
- - ```js + ```json + { + "Version": "2012-10-17", + "Statement": [ { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Action": [ - "sts:assumerole", - "organizations:listaccounts" - ], - "Resource": [ - "*" - ] - } - ] + "Effect": "Allow", + "Principal": { + "AWS": "arn:aws:iam::ROOT_ACCOUNT_ID:role/EC2_D42_RC_ROLE" + }, + "Action": "sts:AssumeRole" } - ``` -
-
-
-4. **Attach the role:**
- - From the EC2 Instances list page, select the EC2 instance created in Step 1. Then click **Actions > Security > Modify IAM role**.
- - From the "Modify IAM role" page, select the IAM Role created in Step 3 and then click **Update IAM role**.
-
-5. **Additional Member Account Configuration for Role Assumption Using Static or Dynamic Account Discovery**
-
- If you're configuring Single Account Discovery, then there are no remaining steps to be done. If you've opted instead for Role Assumption using static or dynamic account discovery, then continue following the steps below:
-
- - Create the discovery policy in each member account to be discovered. Follow Step 2 again, but this time, use the example discovery policy above.
- - Create the discovery role in each member account to be discovered.
-
- Follow Step 3 again, but this time, select **Custom trust policy** instead of **AWS service**. Copy and paste the trust policy below. At the add permissions screen, search for and select the discovery policy created in the previous step.
-
- *Example Trust Policy*
- Click to expand code example
- - ```js - { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Action": [ - "sts:AssumeRole" - ], - "Principal": { - "Service": [ - "ec2.amazonaws.com" - ] - } - } - ] - } - ``` -
-
-
- Replace `ROOT_ACCOUNT_ID` and `EC2_D42_RC_ROLE` with your own values.
-
- - `ROOT_ACCOUNT_ID`: This is the root account ID where the role, which was configured in Step 3, resides.
- - `EC2_D42_RC_ROLE`: This is the name of the role in the root account to establish trust with.
+ ]
+ }
+ ```
+ Click to expand code example
- - ```js - { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Principal": { - "AWS": "arn:aws:iam::ROOT_ACCOUNT_ID:role/EC2_D42_RC_ROLE" - }, - "Action": "sts:AssumeRole" - } - ] - } - ``` -Click to expand the code block
@@ -139,10 +142,10 @@ Navigate to **Subscriptions > Select your Subscription > Access Control (IAM) > #### Tenant Level -If using the Tenant ID for discovery, you must create a Single Role at the tenant level. Navigate to **Management Groups > Select your Azure Tenant Group > Access Control (IAM) > Roles > Add > Add Custom Role**. Give the custom role a name, and a description, then select **Start from scratch** or 88. +If using the Tenant ID for discovery, you must create a single role at the tenant level. Navigate to **Management Groups > Select your Azure Tenant Group > Access Control (IAM) > Roles > Add > Add Custom Role**. Give the custom role a name and a description, then select **Start from scratch** or **Start from JSON**. -1. If using the **Start from scratch** option, you will need to manually select each permission needed for this application to access the desired resources. Select **Add permissions**, search for and select the desired permission, check the relevant box, and choose **Add**. Repeat this for any desired permissions. -2. If using the **Start from JSON** option, copy and paste the in the JSON data, pulling in the necessary permissions from the list in the Discovery section, and save it as a `.json` file. Be sure to change the assignable scope to `/providers/Microsoft.Management/managementGroups/root-management-group-id-goes-here`. Then, upload this file on the Basics page when creating the role, and the permissions will be automatically defined. +1. If using the **Start from scratch** option, manually select each permission needed for this application to access the desired resources. Select **Add permissions**, search for and select the desired permission, check the relevant box, and choose **Add**. Repeat this for any desired permissions. +2. If using the **Start from JSON** option, copy and paste the JSON data, pulling in the necessary permissions from the list in the Discovery section, and save it as a `.json` file. Change the assignable scope to `/providers/Microsoft.Management/managementGroups/root-management-group-id-goes-here`. Then, upload this file on the **Basics** page when creating the role, and the permissions will be automatically defined. After defining the permissions, select **Next** to define the scope this application will have access to. You can define the scope at the subscription level or in any of the nested resource groups (this example uses the subscription level). Select **Next** to review or copy the JSON, then **Next** and **Create**. @@ -150,19 +153,17 @@ To apply the role, go back to the **Access Control (IAM) > Add > Add Role Assign ### Azure Kubernetes Service (AKS) -When **Authentication and Authorization** is set to "Azure AD authentication with Kubernetes RBAC" and **Kubernetes local accounts** is disabled, you must ensure that there is a group configured within the "Cluster admin ClusterRoleBinding" that includes the discovery user/service principal. +When **Authentication and Authorization** is set to **Azure AD authentication with Kubernetes RBAC** and **Kubernetes local accounts** is disabled, ensure that a group is configured within the **Cluster admin ClusterRoleBinding** that includes the discovery user or service principal. -It is important to note that you can specify multiple groups within the **Cluster admin ClusterRoleBinding** selection. +You can specify multiple groups within the **Cluster admin ClusterRoleBinding** selection. This can be useful if you want to keep the discovery user or service principal in a separate, dedicated discovery group rather than adding it to an existing group. -This can be useful if you would like to keep the discovery user/service principal in a separate, dedicated discovery group rather than adding it to an existing group. +## Create an Azure Discovery Job -### Device42 Azure Discovery +You can now configure an Azure discovery job in Device42 using the application details you noted earlier. The limited role you applied prevents access to unnecessary resources while still allowing visibility and discovery of in-scope resources. -Now, you are able to configure an Azure discovery job in Device42 using the application details you noted earlier. The limited role you have applied will prevent access to unnecessary resources, while still allowing for visibility and discovery of what is in scope. +Log in to the Device42 main appliance web console and navigate to **Discovery > Cloud > Add Cloud Autodiscovery**. Give your cloud discovery job a name, select **Microsoft Azure** from the **Cloud Type** dropdown, choose an appropriate remote collector, and select **Service Principal**. The four Azure values you noted earlier are used to configure the discovery job. -Log in to the Device42 main appliance web console and navigate to **Discovery > Cloud > Add Cloud Autodiscovery**. Give your cloud discovery job a name, select **Microsoft Azure** from the **Cloud Type** dropdown, choose an appropriate remote collector, and select **Service Principal**. The four Azure values you noted earlier will now be used to configure the discovery job. - -1. Click the magnifying glass icon for the **Client ID** value and choose **Add Secret** in the window that opens. The username field requires a value, so use it as a label (i.e., Azure Client ID). Next, put the **Application (client) ID** value for the Azure application in the **Password** field. Then, select **Save**. +1. Click the **magnifying glass icon** for the **Client ID** value and choose **Add Secret** in the window that opens. The username field requires a value, so use it as a label (for example, "Azure Client ID"). Next, enter the **Application (client) ID** value for the Azure application in the **Password** field. Then, select **Save**. 2. Repeat this process for the **Subscription ID** and **Client Secret** fields, where the **Subscription ID** and **Client Secret ID** values are entered in the respective password fields of their secret entries. 3. The **Directory (tenant) ID** can be pasted directly into the **Tenant ID** field of the discovery job. @@ -176,7 +177,7 @@ You can set the **Service Level** of the job to be applied to the discovered ite }} /> -**Here, you also have the option to configure any other discovery options as you require:** +You can also configure the following additional discovery options: - You can add vendor metadata as tags or custom fields, edit device name format, and enable Kubernetes discovery to pull in AKS resources. - Every **Vendor** is user-defined. Device42 does not ship with a list of vendors. @@ -211,7 +212,7 @@ You can set the **Service Level** of the job to be applied to the discovered ite - Check **Strip domain name** to have Device42 strip the discovered domain suffix (everything after the first period) from the device instance name. - Choose a category for discovered devices (note that categories are user-defined). -The **Advanced Features** section enables the discovery of database and function resources. +The **Advanced Features** section enables the discovery of database and function resources.Click to expand the code block
@@ -105,11 +107,11 @@ resourcemanager.projects.get
|
|
- V$SESSION
- V$DATABASE
- V$CONTAINERS
- DBA_SEGMENTS
- DBA_OBJECTS
- SYS.ALL_USERS
- DATABASE_COMPATIBLE_LEVEL
- SYS.PRODUCT_COMPONENT_VERSION
|
|
Click to expand the code block
@@ -330,9 +329,9 @@ Cmnd_Alias DEVICE42_ORACLE_RAC = \ ```- Click on the job you want to view in the **Discovery Target** column. You can use the search bar and filters to find a specific database or narrow down your results. @@ -709,7 +706,6 @@ You can view **Discovery Scores** for the database jobs that have been run. dark: useBaseUrl('/assets/images/database-discovery/discovery-scores-page-19.06-dark.png'), }} /> -
- Click **Detailed Discovery Scores** to see additional information. @@ -720,7 +716,6 @@ You can view **Discovery Scores** for the database jobs that have been run. dark: useBaseUrl('/assets/images/database-discovery/discovery-scores-oracle-19.06-dark.png'), }} /> -
### View Discovered Databases diff --git a/docs/auto-discovery/database-discovery/on-premise-databases.mdx b/docs/auto-discovery/database-discovery/on-premise-databases.mdx index 58500ec30..f74200129 100644 --- a/docs/auto-discovery/database-discovery/on-premise-databases.mdx +++ b/docs/auto-discovery/database-discovery/on-premise-databases.mdx @@ -6,12 +6,13 @@ sidebar_position: 2 import ThemedImage from '@theme/ThemedImage' import useBaseUrl from '@docusaurus/useBaseUrl' +On-premises (on-prem) databases are non-cloud database instances identified and returned by Device42 discovery jobs. You can view the discovered on-prem database details, edit fields, and manage related resources. -On-premise (on-prem) databases are non-cloud database instances identified and returned by Device42 autodiscovery jobs. You can view the discovered on-prem database details and related resources. +This page covers how to view, edit, delete, and associate on-prem databases with Business Services. ## View On-Prem Databases -Select **Resources > Databases > On-Prem Databases** from the Device42 menu to display the on-prem databases list. +Select **Resources > Databases > On-Prem Databases** from the main menu.
Click to expand the code block
-```js +```json [ { "client_id": "D42", @@ -142,9 +145,9 @@ When presented with a new or unique data entry, the Enriched Data service may ne ## Enriched Data Connectivity -Please do the following to ensure connectivity with the Enriched Data service: +Do the following to ensure connectivity with the Enriched Data service: -1. Configure the Cloud Connector and check that it is reachable. +1. Configure the **Cloud Connector** and check that it is reachable. 2. Make sure the Enriched Data endpoints are reachable, including the registration endpoint: - `https://registration.device42.com` @@ -152,11 +155,10 @@ Please do the following to ensure connectivity with the Enriched Data service: - `https://enrichai.device42.io/api/normalizations` 3. Register the license online. -4. For enrichment of Software, the Software Enrichment license needs to be listed as Enabled under Tools > Licensing. +4. For software enrichment, the Software Enrichment license must be listed as **Enabled** under **Tools > Licensing**. -Device42 [InsightsAI](/reports/device42-doql/insightsai.mdx) generates queries based on natural language prompts. The prompts you enter are sent to the `ai42.device42.io` endpoint. +## Enriched Data Interface -## Using the Enriched Data Interface Select **Analytics > EnrichAI Data** to display the Enriched Data list page. @@ -169,7 +171,7 @@ Select **Analytics > EnrichAI Data** to display the Enriched Data list page. style={{ width: '90%' }} /> -Click the **Enriched Value** link to view the data record. If desired, you can click the **Lock** button on an Enriched Data record to prevent Device42 from updating it in the future. +Click the **Enriched Value** link to view the data record. Click the **Lock** button on an Enriched Data record to prevent Device42 from updating it in the future.Click to expand the code block
@@ -97,11 +97,10 @@ The following options are available to augment the behavior of `d42-netflow-coll ```-For SNMP v3, we support the following **Auth Protocols**: +Device42 supports the following SNMP v3 **Auth Protocols**: - MD5 - SHA - SHA256 - SHA512 -For SNMP v3, we support the following **Privacy Protocols**: +Device42 supports the following SNMP v3 **Privacy Protocols**: - DES - 3DES - AES -- AES128 +- AES128 - AES192 - AES192C - AES256 - AES256C
-To prevent an unintentionally large number of jobs from running initially, newly created jobs will not run on the first day they are created. If you would like to run a job after its initial creation, click the **Run Now** button on the job summary page that is displayed after you save a new job. +Newly created jobs do not run on the first day they are created to prevent an unintentionally large number of jobs from running initially. To run a job after its initial creation, click the **Run Now** button on the job summary page displayed after you save a new job. The **Run Now** button is also available on the list page (**Discovery > Nmap**).
| As an example, if we were to generate `AVG` physical values from 5-minute intervals, with a point every minute, from the table in the screenshot above, we would get: | The `MIN` setting, instead, would return the smallest value from each set: |
|
|
| As an example, if you were to generate `AVG` physical values from 5-minute intervals, with a point every minute, from the table in the screenshot above, you would get: | The `MIN` setting, instead, would return the smallest value from each set: |
|
|
ReadTransfer:- 00:01 – 100 bytes
- 00:02 – 123 bytes
- 00:03 – 234 bytes
density=3 (see API section for density details), Device42 will print:- 00:01 – 0 bytes
- 00:02 – 23 bytes
- 00:03 – 111 bytes
For example, the following data for ReadTransfer:
| If a user requests data between 00:01 and 00:03 with density=3 (see API section for density details), Device42 prints:
|
+
+
+3. Create a monitoring group, attaching the monitoring role created above.
```
useradmin group add -r
```
-- Create a monitoring user and assign it to the monitoring group created in the step above.
+4. Create a monitoring user and assign it to the monitoring group created above.
```
useradmin user add -g
```
-**Cluster Mode**
+### NetApp Cluster Mode
1. Connect to your NetApp cluster via SSH.
-2. Create a user with the following config:
+2. Create a user with the following configuration:
- - **VServer to discover:** `Permissions contained in the above command
+ + - `api-system-get-version` + - `login-http-admin` + - `security-api-vfiler` + - `api-system-get-info` + - `api-fcp-adapter-list-info` + - `api-iscsi-initiator-list-info` + - `api-iscsi-adapter-list-info` + - `api-disk-list-info` + - `api-aggr-list-info` + - `api-volume-list-info` + - `api-lun-list-info` + - `api-qtree-list` + - `api-quota-list-entries` + - `api-cifs-share-list-iter-start` + - `api-perf-object-get-instances` + - `api-lun-map-list-info` + - `api-cifs-share-list-iter-next` + - `api-lun-get-serial-number` + +
+
+
+You can also use CLI commands to create roles:
1. Log in to the cluster using SSH.
@@ -114,65 +115,70 @@ Create a new role and add the following read-only permissions:
- To create a read-only role:
```
- isi auth roles create –name readonly_role –description “Read-only role for D42”
+ isi auth roles create --name readonly_role --description “Read-only role for D42”
```
- - To give permissions to this role add all the permissions from above:
+ - To give permissions to this role, add all the permissions from above:
```
- isi auth roles modify readonly_role –add-priv-ro=ISI_PRIV_LOGIN_PAPI
+ isi auth roles modify readonly_role --add-priv-ro=ISI_PRIV_LOGIN_PAPI
```
- - To create a USER:
+ - To create a user:
```
- isi auth users create readonly_user –enabled yes –password xxxxxx
+ isi auth users create readonly_user --enabled yes --password xxxxxx
```
- To add a user to the role:
```
- isi auth roles modify readonly_role –add-user=readonly_user
+ isi auth roles modify readonly_role --add-user=readonly_user
```
-**Alternatively, you can create the Role/User via the web UI**
+Alternatively, you can create the role and user via the web UI:
1. Log in to the cluster web UI.
-2. Select **Access Tab → Membership & Roles**.
-3. Select the **Users** tab.
+2. Select **Access Tab > Membership & Roles**.
+3. Select the **Users** tab.
4. Select **LOCAL: System** for the provider.
-5. Create user:
+5. Create a user:
- Set the username and password.
- Select **Users** as the primary group.
- Enable the account.
-7. Select the **Roles** tab.
-8. Create a role:
+6. Select the **Roles** tab.
+7. Create a role:
- Set the **Role Name**.
- Add the member (the user created above).
- Add the following privileges as read-only:
- - Console
- - Platform API
- - SSH
- - Shutdown
- - Support
- - Auth
- - Audit
- - Cluster
- - Devices
- - FTP
- - HDFS
- - HTTP
- - Monitoring
- - NDMP
- - Network
- - NFS
- - Remote Support
- - SmartPools
- - SMB
- - Statistics
- - Namespace Traverse
- - Namespace Acces_s
+ Isilon read-only permissions
+ +- `ISI_PRIV_LOGIN_CONSOLE` +- `ISI_PRIV_LOGIN_PAPI` +- `ISI_PRIV_LOGIN_SSH` +- `ISI_PRIV_SYS_SHUTDOWN` +- `ISI_PRIV_SYS_SUPPORT` +- `ISI_PRIV_AUTH` +- `ISI_PRIV_AUDIT` +- `ISI_PRIV_CLUSTER` +- `ISI_PRIV_DEVICES` +- `ISI_PRIV_FTP` +- `ISI_PRIV_HDFS` +- `ISI_PRIV_HTTP` +- `ISI_PRIV_MONITORING` +- `ISI_PRIV_NDMP` +- `ISI_PRIV_NETWORK` +- `ISI_PRIV_NFS` +- `ISI_PRIV_NS_TRAVERSE` +- `ISI_PRIV_NS_IFS_ACCESS` +- `ISI_PRIV_QUOTA` +- `ISI_PRIV_REMOTE_SUPPORT` +- `ISI_PRIV_SMARTPOOLS` +- `ISI_PRIV_SMB` +- `ISI_PRIV_STATISTICS` + +
+
diff --git a/docs/auto-discovery/storage-arrays-autodiscovery/hp-autodiscovery.mdx b/docs/auto-discovery/storage-arrays-autodiscovery/hp-autodiscovery.mdx
index f090023f3..ab9072b29 100644
--- a/docs/auto-discovery/storage-arrays-autodiscovery/hp-autodiscovery.mdx
+++ b/docs/auto-discovery/storage-arrays-autodiscovery/hp-autodiscovery.mdx
@@ -3,52 +3,55 @@ title: "HP Autodiscovery"
sidebar_position: 2
---
-Follow the steps below to set up read-only users for HP Storage Array autodiscovery.
+Device42 discovers HP and HPE storage arrays including Nimble, 3PAR, and StoreEasy. This page lists the access protocols and default ports for each array, and provides steps for setting up users with minimum read-only permissions.
+
+For general storage array discovery job setup, see [Storage Arrays Discovery](index.mdx).
## Access Protocols by Array
| Vendor | Array | Access Mechanism | Default Port |
|--------|-------|------------------|--------------|
| HP | Nimble | REST | 5392 |
-| HP | 3PAR | SMIS | 5988 / 5989 |
+| HP | 3PAR | SMIS | 5988 or 5989 |
| HPE | StoreEasy | REST | 49258 |
-## Minimum Permissions for Storage Array Autodiscovery
+## Minimum Permissions for Storage Array Discovery
-The sections below guide you through how to set up users or roles with minimum read-only permissions that you can use when you create storage array autodiscovery jobs.
+Follow the steps below to set up users or roles with minimum read-only permissions for storage array discovery jobs.
### HP Nimble
-1. Log in to the Nimble console.
-2. Select **Administration → Security** from the menu.
-3. Click on **Users and Groups** in the left panel.
-4. Click on the **+USER** button to open the Create User panel.
-5. Create a user and assign them one of the available roles:
-
- - administrator
- - power-user
- - operator
- - guest
+Create a user with `operator` permissions on the Nimble console.
-6. Select the minimum **operator** role.
-8. Click **OK** and save the user.
+1. Log in to the Nimble console.
+2. Select **Administration > Security** from the menu.
+3. Click **Users and Groups** in the left panel.
+4. Click the **+USER** button to open the Create User panel.
+5. Create a user and assign the minimum `operator` role. The available roles are:
+ - `administrator`
+ - `power-user`
+ - `operator`
+ - `guest`
+6. Click **OK** and save the user.
### HPE StoreEasy
-The StoreEasy platform relies on local users created at the server level. Currently, Admin access is required to run a successful discovery.
+The StoreEasy platform relies on local users created at the server level. Admin access is required to run a successful discovery.
1. Create a local user on the HPE StoreEasy host server.
-2. Add that user to the admin group.
+2. Add that user to the `admin` group.
### HP 3PAR
+Create a user with the `browse` role on the HP 3PAR Management Console.
+
1. Log in to the HP 3PAR Management Console.
-2. Click on the **Actions** menu.
-3. Select the **Security & Domains** submenu
-4. Select **Users** and then **Create User**.
-5. Enter a username and password and click **Next**.
-6. Grant the user the **browse** role on the appropriate domain.
-7. Click **Finish** and save the user.
+2. Click the **Actions** menu.
+3. Select the **Security & Domains** submenu.
+4. Select **Users** and then **Create User**.
+5. Enter a username and password, and click **Next**.
+6. Grant the user the `browse` role on the appropriate domain.
+7. Click **Finish** and save the user.
**Example CLI user creation:**
diff --git a/docs/auto-discovery/storage-arrays-autodiscovery/ibm-autodiscovery.mdx b/docs/auto-discovery/storage-arrays-autodiscovery/ibm-autodiscovery.mdx
index 920c7caaf..522d70ab6 100644
--- a/docs/auto-discovery/storage-arrays-autodiscovery/ibm-autodiscovery.mdx
+++ b/docs/auto-discovery/storage-arrays-autodiscovery/ibm-autodiscovery.mdx
@@ -3,35 +3,37 @@ title: "IBM Autodiscovery"
sidebar_position: 3
---
-This page details access protocols and how to configure read-only user accounts with minimum permissions for use in IBM storage array autodiscovery.
+Device42 discovers IBM storage arrays including V7000 and Storwize. This page lists the access protocols and default ports, and provides steps for setting up users with minimum read-only permissions.
-## Access Protocols by Array3
+For general storage array discovery job setup, see [Storage Arrays Discovery](index.mdx).
+
+## Access Protocols by Array
| Vendor | Array | Access Mechanism | Default Port |
|--------|-------|------------------|--------------|
-| IBM | V7000 / StorWize | REST | 7443 |
-
-## Minimum Permissions for Storage Array Autodiscovery
-
-Follow the steps in the sections below to set up users or roles with minimum read-only permissions that you can use when you create storage array autodiscovery jobs.
-
-### IBM V7000/StoreWize
-
-1. Log into the IBM V7000 Management Console.
-2. Click on _Access → Users_ Panel.
-3. Click on _Create Group_.
-4. Select one of the role from the available roles:
- - SecurityAdmin
- - Admin
- - ExportAdmin
- - StorageAdmin
- - SnapAdmin
- - SystemAdmin
- - CopyOperator
- - Monitor
- - Service
- - Enahanced
-
- Select the minimum _**Monitor**_ role.
-5. Click **Finish** and save the Group.
-6. Create a new User and add the User to the Group.
+| IBM | V7000 or Storwize | REST | 7443 |
+
+## Minimum Permissions for Storage Array Discovery
+
+Follow the steps below to set up users or roles with minimum read-only permissions for storage array discovery jobs.
+
+### IBM V7000 or Storwize
+
+Create a group with the `Monitor` role and add a user to it.
+
+1. Log in to the IBM V7000 Management Console.
+2. Click **Access > Users**.
+3. Click **Create Group**.
+4. Create a group and assign the minimum `Monitor` role. The available roles are:
+ - `SecurityAdmin`
+ - `Admin`
+ - `ExportAdmin`
+ - `StorageAdmin`
+ - `SnapAdmin`
+ - `SystemAdmin`
+ - `CopyOperator`
+ - `Monitor`
+ - `Service`
+ - `Enhanced`
+5. Click **Finish** and save the group.
+6. Create a new user and add the user to the group.
diff --git a/docs/auto-discovery/storage-arrays-autodiscovery/index.mdx b/docs/auto-discovery/storage-arrays-autodiscovery/index.mdx
index b9b539e7f..5c79bf67b 100644
--- a/docs/auto-discovery/storage-arrays-autodiscovery/index.mdx
+++ b/docs/auto-discovery/storage-arrays-autodiscovery/index.mdx
@@ -6,26 +6,28 @@ sidebar_position: 28
import ThemedImage from '@theme/ThemedImage'
import useBaseUrl from '@docusaurus/useBaseUrl'
-Storage Arrays are identified and returned by Device42 Storage Arrays autodiscovery. On the Storage Discovery page, you will find resource details, related resources, and topology maps.
+Device42 storage array discovery identifies and returns storage arrays from a wide range of vendors, including Dell/EMC, HP, IBM, NetApp, Pure Storage, and more. Discovered resources include resource details, related resources, and topology maps.
+
+This page lists the supported storage array platforms, links to vendor-specific discovery details, and explains how to create and schedule a storage array discovery job.
## Storage Array Platforms
-Click the **Platform** dropdown to view and select the available storage array type for a discovery job.
+Click the **Platform** dropdown to view and select the available storage array types for a discovery job.
-If you want to see the discovered storage arrays on the Devices list page, then discover storage arrays by SNMP.
+To see discovered storage arrays on the Devices list page, discover them using [SNMP SAN/Server discovery](snmp-san-server-auto-discovery.mdx).
Isilon web UI privileges
+ + - Console + - Platform API + - SSH + - Shutdown + - Support + - Auth + - Audit + - Cluster + - Devices + - FTP + - HDFS + - HTTP + - Monitoring + - NDMP + - Network + - NFS + - Remote Support + - SmartPools + - SMB + - Statistics + - Namespace Traverse + - Namespace Access + +-
### Set the Model Field -The data Normalization and Enrichment Service has largely automated this requirement: Set the **Model** field to **Dell**, **IBM**, **Lenovo**, or **Meraki**. Hardware with different vendor name variations will not return a warranty. +The data Normalization and Enrichment Service has largely automated this requirement. Set the **Model** field to **Dell**, **IBM**, **Lenovo**, or **Meraki**. Hardware with different vendor name variations will not return a warranty. You can easily add the proper **Vendor Aliases** to the vendors if your vendors are named differently. On the vendor edit screen, update the vendor entries. Enter `dell` for Dell, `ibm` for IBM, `meraki` for Meraki, and `lenovo` for Lenovo: @@ -82,21 +82,33 @@ You can easily add the proper **Vendor Aliases** to the vendors if your vendors ### Get Your API Key -**Dell API key**: Instructions for obtaining a Dell API key are now available from [TechDirect](https://tdm.dell.com/td-auth?lang=en_UShttps://techdirect.dell.com/Portal/Login.aspx?ReturnUrl=%2Fportal%2FAboutAPIs.aspxtdLegacyUrl=%2Fportal%2FAboutAPIs.aspx), which requires a valid Dell login. +- **Dell API key:** Instructions for obtaining a Dell API key are available from [TechDirect](https://tdm.dell.com/td-auth?lang=en_UShttps://techdirect.dell.com/Portal/Login.aspx?ReturnUrl=%2Fportal%2FAboutAPIs.aspxtdLegacyUrl=%2Fportal%2FAboutAPIs.aspx), which requires a valid Dell login. +- **Meraki API keys:** Device42 requires you to [obtain a Meraki API key](https://developer.cisco.com/meraki/api-v1/#!authorization/obtaining-your-meraki-api-key) in order to retrieve warranty information. +- **Lenovo API keys:** Lenovo provides a warranty lookup API key to customers who request it via Lenovo Sales or Support Account Representatives. +- **IBM API keys:** Log in to your [IBM account](https://login.ibm.com/authsvc/mtfim/sps/authsvc?PolicyId=urn:ibm:security:authentication:asf:basicldapuser&Target=https%3A%2F%2Flogin.ibm.com%2Foidc%2Fendpoint%2Fdefault%2Fauthorize%3FqsId%3D18d7b5a9-bbe1-4d66-9e31-57a48ef148c5%26client_id%3DOGMyMGQ1MzQtZDFhYi00) to access your warranty lookup information. -**Meraki API keys**: Device42 requires you to [obtain a Meraki API key](https://developer.cisco.com/meraki/api-v1/#!authorization/obtaining-your-meraki-api-key) min order to retrieve warranty information. +### Cisco Support API Info -**Lenovo API keys**: Lenovo provides a warranty lookup API key to customers who request it via Lenovo Sales or Support Account Representatives. +:::info +The required Cisco API, SN2INFO, is not available by default. You need to request access from Cisco. +::: -**IBM API keys**: Log in to your [IBM account](https://login.ibm.com/authsvc/mtfim/sps/authsvc?PolicyId=urn:ibm:security:authentication:asf:basicldapuser&Target=https%3A%2F%2Flogin.ibm.com%2Foidc%2Fendpoint%2Fdefault%2Fauthorize%3FqsId%3D18d7b5a9-bbe1-4d66-9e31-57a48ef148c5%26client_id%3DOGMyMGQ1MzQtZDFhYi00) to access your warranty lookup information. +Cisco warranty discovery uses the [Serial Number to Information](https://developer.cisco.com/docs/support-apis/#!serial-number-to-information/get-coverage-summary-by-serial-numbers) (SN2INFO) API and the following endpoint: +`https://apix.cisco.com/sn2info/v2/coverage/summary/serial_numbers/{sr_no,sr_no,sr_no}.` -:::note -If using the standalone warranty script (instructions in the **STANDALONE** section below), Python 2.7 must be installed along with the python library requests. -::: +To get access, [register an application](https://developer.cisco.com/docs/support-apis/#!application-registration/application-registration) on the Cisco API console. When registering, select only the **Client Credentials** checkbox and nothing else; this allows you to use your client ID and secret to generate an OAuth 2.0 authorization token for API requests. + +Most of the configuration information required for a successful Cisco warranty discovery is entered in the App Registration form in the Cisco API console. + +The **Application Type** should be set to **Service**. Once registered, the API should be enabled and displayed in the **My Apps & Keys** section. + +### Meraki Details + +For Meraki warranty discovery, all access points with corresponding serial numbers and hardware models need to have **Meraki** set as the vendor prior to sync. ## Secure Communication Details -Both the UI and the warranty script transmit the same information (relevant serial number(s)) to the appropriate vendor via port 443 SSL. This only includes the API key entered into Device42 if required by the vendor (Dell or Meraki). Payload looks as follows: +Both the UI and the warranty script transmit the same information (relevant serial numbers) to the appropriate vendor via port 443 SSL. The API key entered into Device42 is only included if required by the vendor (Dell or Meraki). The payload looks as follows: ``` payload = {'id': inline_serials, 'apikey': self.api_key, 'accept': 'Application/json'} @@ -110,19 +122,21 @@ Lenovo/IBM - support.lenovo.com https port 443 Meraki - api.meraki.com https port 443 ``` -## Configuring a Job With an API Key +## Configure a Job With an API Key -1. Select **Discovery > Warranty Sync** from the main menu, click **Create**, and **Name** your job. +To set up a warranty discovery job: + +1. Select **Discovery > Warranty Sync** from the main menu, click **Create**, and name your job. 2. Select a **Vendor**: - For Dell or Meraki, be sure to enter your matching API key (see the **API Keys** section above for details on obtaining a Dell or Meraki API key). If you select Dell, ensure you choose the API version from the dropdown. + For Dell or Meraki, enter your matching API key (see the [Get Your API Key](#get-your-api-key) section for details). If you select Dell, choose the API version from the dropdown. - For IBM or Lenovo, you are required to be a large enterprise customer and need to contact a sales representative who will put you in contact with the correct team for the API key. + For IBM or Lenovo, you need to be a large enterprise customer and contact a sales representative who will connect you with the correct team for the API key. -3. Add your API key right by clicking the magnifying glass on the **Access Key** field, clicking **Add Password** in the upper-right corner of the popup, and add your key as shown below. Repeat these steps for the **Secret Key** if necessary. +3. Add your API key by clicking the magnifying glass on the **Access Key** field, clicking **Add Password** in the upper-right corner of the popup, and adding your key as shown below. Repeat these steps for the **Secret Key** if necessary. 4. Choose your **Order Number Type** and **Debug level** options. 5. Set a schedule if desired and save the job. -6. Go ahead and run the job! +6. Run the job.
`netstat HOSTNAME` or IP | +| Ping or netstat Windows host | `ping HOSTNAME` or IP
`netstat HOSTNAME` or IP | | Test port 135 (for WMI) | PowerShell: `Test-NetConnection -ComputerName HOST -Port 135` | | If using WinRM, test port 5985 (HTTP) or 5986 (HTTPS) | `Test-NetConnection -ComputerName HOST -Port 5985` | | Hostname resolves correctly | `nslookup HOSTNAME` | -| If using IPs, DNS isn't required | Ensure IPs are pingable | +| If using IPs, DNS is not required | Ensure IPs are pingable | ## 3. Authentication Validation +Confirm that the credentials used by the discovery job are valid and correctly configured. + | Check | Notes | |-------|-------| -| Credentials are valid and **not expired/locked** | Try login via RDP to confirm | +| Credentials are valid and **not expired or locked** | Try logging in via RDP to confirm | | Domain credentials are fully qualified (e.g. `DOMAIN\user`) | Required for remote auth | -| If using gMSA, WDS service is running as the gMSA | Check Windows Service "Log On As" | -| For gMSA, discovery job set to "Use Service Account Credentials" | Only works with WDS | +| If using gMSA, WDS service is running as the gMSA | Check Windows Service **Log On As** | +| For gMSA, discovery job set to **Use Service Account Credentials** | Only works with WDS | ## 4. Firewall and Port Configuration -On **target** Windows host: +Check the following firewall rules and port settings on the **target** Windows host. | Item | Command / Notes | |------|-----------------| -| Port 135 allowed (for WMI/DCOM) | Windows Firewall inbound rule: "WMI (DCOM-In)" | -| WMI rule enabled | "Windows Management Instrumentation (WMI-In)" | +| Port 135 allowed (for WMI and DCOM) | Windows Firewall inbound rule: **WMI (DCOM-In)** | +| WMI rule enabled | **Windows Management Instrumentation (WMI-In)** | | Ephemeral port range not blocked | Allow dynamic ports or set custom port range for WMI | | WinRM enabled and allowed (if using WinRM) | Run: `winrm quickconfig` on target | | WinRM listener exists | `winrm enumerate winrm/config/listener` | -| WinRM firewall rule enabled | "Windows Remote Management (HTTP-In)" | +| WinRM firewall rule enabled | **Windows Remote Management (HTTP-In)** | -## 5. WMI / WinRM Functionality Tests +## 5. WMI and WinRM Functionality Tests -From WDS or discovery system: +Run these commands from the WDS or discovery system to verify that WMI and WinRM are functioning correctly. ### WMI Test @@ -66,41 +72,47 @@ Get-WmiObject -Class Win32_OperatingSystem -ComputerName TARGET -Credential (Get Test-WSMan TARGET ``` -Or: +Or use the `winrm` command directly: ```powershell winrm id -r:TARGET ``` -| Result | Expect | +| Result | Expected Outcome | |--------|--------| -| WMI command succeeds | Returns OS info | -| WinRM test returns 200 OK | WinRM properly set up | +| WMI command succeeds | Returns OS information | +| WinRM test returns 200 OK | WinRM is properly configured | -## 6. Permission / Namespace Access +## 6. Permission and Namespace Access + +Verify that the discovery account has the required permissions on the target host. | Item | Notes | |------|-------| -| Account has remote WMI permissions | Can use Device42 WMI Tester | -| Can connect to `\\TARGET\root\cimv2` | Use Device42 WMI Tester | +| Account has remote WMI permissions | Use the Device42 WMI Tester to verify | +| Can connect to `\\TARGET\root\cimv2` | Use the Device42 WMI Tester to verify | | Account is in **Distributed COM Users** | Or granted DCOM launch permissions manually | | Account is in **Performance Monitor/Log Users** (optional) | For perf counters | | Account is in **Event Log Readers** (optional) | For Windows events | ## 7. Device42 Job-Specific Settings +Review the following settings within your Device42 discovery job. + | Check | Notes | |-------|-------| | Discovery job set to correct **protocol** (WMI or WinRM) | WinRM recommended where possible | -| Selected WDS is online and has connectivity | Test from same system | -| Job runs with **Debug** enabled for verbose logs | Review log output in Job History | -| Device42 not behind proxy blocking outbound port 443 | For job report / updates | +| Selected WDS is online and has connectivity | Test from the same system | +| Job runs with **Debug** enabled for verbose logs | Review log output in **Job History** | +| Device42 not behind proxy blocking outbound port 443 | For job report and updates | ## 8. If the Job Still Fails +If you have completed the checks above and the job still fails, try the following additional steps. + | Step | Notes | |------|-------| -| Use Device42 **WMI Test Tool** | [Download from Device42](/how-to-videos/wmi-authentication-testing-tool-how-to.mdx) | +| Use the Device42 **WMI Test Tool** | [Download from Device42](/how-to-videos/wmi-authentication-testing-tool-how-to.mdx) | | Use WBEMTest locally | Connect to `\\TARGET\root\cimv2` with credentials | -| Review Device42 job logs for authentication errors | Check for "Access Denied" vs "RPC Unavailable" vs other | -| [Open support ticket with Device42](https://support.device42.com/hc/en-us)| Include logs, test results, account details, and network path info | +| Review Device42 job logs for authentication errors | Check for `Access Denied` vs `RPC Unavailable` vs other errors | +| [Open a support ticket with Device42](https://support.device42.com/hc/en-us) | Include logs, test results, account details, and network path info | diff --git a/docs/auto-discovery/z-os-ibm-mainframe.mdx b/docs/auto-discovery/z-os-ibm-mainframe.mdx index d7a29f02c..4a2045d89 100644 --- a/docs/auto-discovery/z-os-ibm-mainframe.mdx +++ b/docs/auto-discovery/z-os-ibm-mainframe.mdx @@ -7,51 +7,56 @@ import ThemedImage from '@theme/ThemedImage' import useBaseUrl from '@docusaurus/useBaseUrl' :::tip -Are you looking to discover an IBM i/AS400 midrange system? [Click here for the IBM i/AS400 docs page](ibm-i-as400.mdx). +Looking to discover an IBM i/AS400 midrange system? See the [IBM i/AS400 docs page](ibm-i-as400.mdx). ::: -Device42 can discover IBM mainframes running the z/OS operating system, and like most discovery jobs, z/OS discovery can be scheduled to run automatically. +Device42 can discover IBM mainframes running the z/OS operating system, collecting device details, IP addresses, hardware information, services, and disk space data. Like most discovery jobs, z/OS discovery can be scheduled to run automatically. -## IBM z/OS Discovery Job Prerequisites and Information +This page covers prerequisites, how to create and configure an IBM z/OS discovery job, and the latest discovery enhancements. + +## Discovered Information + +IBM z/OS discovery jobs collect the following details: -- **License requirement**: IBM z/OS discovery requires a license. -- **Compatibility**: IBM z/OS discovery works for almost all z/OS systems. -- **Discovered details**: IBM z/OS discovery jobs currently find: - - Device names - - IP addresses (both v4/v6) - - Machine information (serials, capacities, manufacturers, device names) - - OS versions - - Hardware (CEC units) - - Services attached to service ports -- **FTP configuration**: Discovery happens via FTP on port 21. FTP **must** be enabled and connections accepted for an IBM z/OS discovery to succeed. +- Device names +- IP addresses (both IPv4 and IPv6) +- Machine information (serials, capacities, manufacturers, device names) +- OS versions +- Hardware (CEC units) +- Services attached to service ports - Our FTP discovery expects to use the default IBM translation tables — if you encounter an issue with this, please [contact Device42 Support](https://support.device42.com/). +## IBM z/OS Discovery Job Prerequisites and Information + +Review the following requirements and details before setting up an IBM z/OS discovery job. -- **Netstat communication**: Device42 requires access to the TSO `NETSTAT CONN` command. -- **Permission**: Collecting disk information requires access to the `STGADMIN.IDC.DCOLLECT` profile. -- **Security** No special security rights are required. A standard TSO logon is sufficient. +- **License requirement:** IBM z/OS discovery requires a license. +- **Compatibility:** IBM z/OS discovery works for almost all z/OS systems. +- **FTP configuration:** Discovery happens via FTP on port 21. FTP **must** be enabled and connections accepted for an IBM z/OS discovery to succeed. The FTP discovery expects to use the default IBM translation tables. If you encounter an issue with this, [contact Device42 Support](https://support.device42.com/). +- **Netstat communication:** Device42 requires access to the TSO `NETSTAT CONN` command. +- **Permission:** Collecting disk information requires access to the `STGADMIN.IDC.DCOLLECT` profile. +- **Security:** No special security rights are required. A standard TSO logon is sufficient. -Discovery is a non-intrusive process, as no files are created on the z/OS system and no software is installed on the z/OS system. +Discovery is a non-intrusive process, as no files are created and no software is installed on the z/OS system. One discovery job must be created **per job card**. If multiple instances share the same job card (as configured), they can be discovered in the same job, but this is often not the case. ## IBM z/OS Discovery Updates -Device42 has enhanced IBM z/OS discovery with additional capabilities and device results. +Device42 has enhanced IBM z/OS discovery with the following additional capabilities and device results. -- **Processor information**: The number of IBM z Integrated Information Processors (zIIPs) and IBM z Application Assistance Processors (zAAPs) are recorded as components on the device record. -- **Disk space details**: The number of drives, their capacity, and their space used (in TB) are captured as mount points on the device. Note: Access to the `STGADMIN.IDC.DCOLLECT` profile is required to collect disk information. -- **User and connection data**: Information on current TSO users, TN3270 connections, and GCP processor capacity in MIPS is added in the form of extra fields on the device record. -- **Database and queue managers**: The data of executing DB Managers for DB2 and IMS/IBM MQ Managers is captured as **Services**. +- **Processor information:** The number of IBM z Integrated Information Processors (zIIPs) and IBM z Application Assistance Processors (zAAPs) are recorded as components on the device record. +- **Disk space details:** The number of drives, their capacity, and their space used (in TB) are captured as mount points on the device. Access to the `STGADMIN.IDC.DCOLLECT` profile is required to collect disk information. +- **User and connection data:** Information on current TSO users, TN3270 connections, and GCP processor capacity in MIPS is added as extra fields on the device record. +- **Database and queue managers:** The data of executing DB Managers for DB2 and IMS or IBM MQ Managers is captured as **Services**. ## Create an IBM z/OS Mainframe Discovery Job -Navigate to **Discovery > HyperVisors / \*nix / Windows**, and click **Create** to create a new discovery job. +Navigate to **Discovery > HyperVisors / \*nix / Windows** and click **Create** to create a new discovery job. The following options are available. -- **Job Name:** Enter a unique name to identify the IBM z/OS autodiscovery job. -- **Remote Collector:** Optionally, specify a Remote Collector from which to run discovery, instead of from the Main Appliance. -- **Job Debug level**: Turn debug on or off. -- **Platform:** Select **BM z/OS** for mainframe discovery. +- **Job Name:** Enter a unique name to identify the IBM z/OS discovery job. +- **Remote Collector:** Optionally, specify a Remote Collector from which to run discovery instead of from the Main Appliance. +- **Job Debug level:** Turn debug on or off. +- **Platform:** Select **IBM z/OS** for mainframe discovery. - **Discovery Target(s):** Specify the FQDN or IP address of the IBM z/OS target you want to discover. If using FQDN, ensure Device42 is set up to resolve DNS. Configure the DNS settings in your Device42 virtual machine (VM) console. - **Port:** Only change this if your admin has configured a custom listening port. IBM z/OS discovery uses FTP port 21 by default. - **ADM Sampling Interval:** Specify the application dependency mapping (ADM) data collection interval. @@ -64,85 +69,85 @@ Navigate to **Discovery > HyperVisors / \*nix / Windows**, and click **Create** }} /> -- **Discovery Target(s) Credential(s):** Specify a username with permissions on your z/OS mainframe. Usernames are not case sensitive on z/OS. +- **Discovery Target(s) Credential(s):** Specify a username with permissions on your z/OS mainframe. Usernames are not case-sensitive on z/OS. -
-The **OS** name, **OS Version**, and **OS Version #** fields are the basic operating system (OS) details for each device. If the data Normalization and Enrichment Service is active and the data is available, these fields may be automatically populated by the autodiscovery client. The vendor support details, like the **End of Life** and **End of Support** fields, may also be autopopulated. If the Enriched Data service is disabled, you can manually enter the relevant data or execute scripts to populate the fields. Note that the **OS License Key** field can also be entered manually. +The **OS**, **OS Version**, and **OS Version #** fields hold the basic operating system details for each device. If the Normalization and Enrichment Service is active, these fields may be automatically populated by discovery. Vendor support details like **End of Life** and **End of Support** may also be autopopulated. If the Enriched Data service is disabled, you can manually enter the data or run scripts to populate the fields. The **OS License Key** field can also be entered manually. -The **Count In Licensing** option is checked by default and can be unchecked if it doesn't count towards the OS licensing for the device OS. Check the **Don't change via api** option if you don't want the property values to be changed via autodiscovery. +**Count In Licensing** is checked by default. Uncheck it if the OS does not count towards licensing. Select **Don't change via api** if you have manually set these values and don't want discovery jobs to overwrite them. -Note that if the Operating System fields are blank, you may need to rerun autodiscovery. +If the Operating System fields are blank, you may need to rerun discovery. ## Rack Info -Rack information is no longer shown under the device **Properties** tab. To locate the list of physical devices, navigate to **Resources > All Assets**. You can view and edit rack information by clicking on an asset and scrolling to the **Rack Info** section. +Rack information is no longer on the **Properties** tab. Navigate to **Resources > All Assets**, click an asset, and scroll to the **Rack Info** section to view or edit rack details. ## Ports Connectivity -From the **Ports** section, you can **Add New** and **Add Existing** connections. You can also **Edit** connections or delete them using the **trash can** icon at the far right (not pictured). +From the **Ports** section, you can **Add New** and **Add Existing** connections. You can also **Edit** connections or delete them using the **trash can icon** at the far right.
## Device Alias and Non-Authoritative Alias -You can add multiple aliases to a device using the **+ Add New** button. Toggle on **Is Preferred** for one of the aliases. Then, you can add one or many **Device Non-Authoritative Alias** to associate nicknames with the device. +Devices often have multiple names — a short hostname, a fully qualified domain name, or names used by different teams. Aliases let you track all of these and choose which name displays in charts and topology maps. + +Add multiple aliases to a device using **+ Add New**. Toggle **Is Preferred** for one of the aliases. You can also add **Device Non-Authoritative Alias** entries to associate nicknames with the device.
- -Both the device alias and non-authoritative alias add alternate names for the device. You can search for a device using its authoritative alias. However, only the preferred alias is used for device matching during an autodiscovery job. - -The preferred alias will be the name that appears in device topology maps, impact charts, and dependency charts. The preferred alias is also displayed when adding a device to a business application. -For example, a device named "0101-DEV01" has the preferred alias "0101-DEV01.gov.it". +Both alias types add alternate names for the device. You can search for a device using its authoritative alias. However, only the preferred alias is used for device matching during a discovery job. -- The preferred alias is displayed on the topology map: +The preferred alias is the name that appears in topology maps, impact charts, and dependency charts. It is also displayed when adding a device to a Business Service. -