cancel
Showing results for 
Search instead for 
Did you mean: 
Create Post
Level 9

Repository for Network Sonar Discovery Results

Jump to solution

Hello all,

I am trying to build a custom report using Report Writer to pull the data found by the Network Sonar Discovery Results.  I would like to audit those nodes found, but I need it in structured data rather than the screenshot that is the 'Export to PDF' option on the web console.

Again, I am looking for the table that stages the discovered data before you choose whether to import or ignore those results.

Any help would be appreciated.

Thanks,

J

0 Kudos
1 Solution

It is very similar for versions before NPM 10.2.

Base entrypoint table is DiscoveryProfiles again.

Other related tables have prefix "Discovery". Some of them store setting for discovery which has been entered by user in discovery wizard:

DiscoverySNMPCredentialsV3
DiscoverySNMPCredentials
DiscoveryProfileSearchRanges
DiscoveryProfileSubnets
DiscoveryProfileIPBulk
DiscoveryProfileOptions
DiscoveryProfileCredentialsV3
DiscoveryProfileCredentials
DiscoveryProfileVMwareCredentials

Following tables contain discovery results:

DiscoveryVendors
DiscoverySubnets (found subnets)
DiscoveryNodes (found nodes)
DiscoveryPhysicalInterfaces (found interfaces)
DiscoveryNodeVMWare (additional information about found nodes which where recognized as VMware machines)
DiscoveryNodeStorage (found volumes)
DiscoveryNodeNames (all names for found nodes)
DiscoveryNodeFlags
DiscoveryEndPoints
DiscoveryIPAddresses (list of all IP addresses for found nodes)
DiscoveryNodeCredentialsV3 (which credentials from DiscoverySNMPCredentialsV3 can be used for given node)
DiscoveryNodeCredentials (which credentials from DiscoverySNMPCredentials can be used for given node)
DiscoverySubnetEdges
DiscoveryEdges
DiscoveryBypassEdges

There is only one relevant timestamp which is stored in table DiscoveryProfiles, column LastRun.

Examples:

List of all nodes from all discovery profiles with all IP and MAC addresses ordered by time of discovery.

SELECT
  DP.Name AS ProfileName,
  DP.LastRun AS DiscoveredAt,
  DN.Name AS NodeName,
  DIP.IPAddress AS IPAddress,
  DIP.EthernetAddress AS MAC
FROM DiscoveryNodes AS DN
INNER JOIN DiscoveryProfiles AS DP
ON
  DP.ProfileID = DN.ProfileID
INNER JOIN DiscoveryIPAddresses AS DIP
ON
  DIP.NodeID = DN.NodeID
  AND DIP.ProfileID = DN.ProfileID
ORDER BY
  DP.LastRun,
  DN.ProfileID,
  DN.NodeID

List of all nodes from all discovery profiles with primary address of node and with all found interfaces:

SELECT
  DP.Name AS ProfileName,
  DP.LastRun AS DiscoveredAt,
  DN.Name AS NodeName,
  DN.PrimaryAddress AS IPAddress,
  DI.IfxName AS InterfaceName
FROM DiscoveryNodes AS DN
INNER JOIN DiscoveryProfiles AS DP
ON
  DP.ProfileID = DN.ProfileID
INNER JOIN DiscoveryPhysicalInterfaces AS DI
ON
  DI.NodeID = DN.NodeID
  AND DI.ProfileID = DI.ProfileID
ORDER BY
  DP.LastRun,
  DN.ProfileID,
  DN.NodeID

List of all unique nodes found in all discoveries with information in which discovery was node most recently and how many discoveries found given node:

SELECT
  DN.PrimaryAddress,
  MAX(DP.LastRun) AS LastFound,
  (SELECT TOP 1 Name FROM DiscoveryProfiles WHERE LastRun >= MAX(DP.LastRun)) AS LastFoundInProfile,
  COUNT(*) As TotallyFound
FROM DiscoveryNodes AS DN
INNER JOIN DiscoveryProfiles AS DP
ON
  DP.ProfileID = DN.ProfileID
GROUP BY
  DN.PrimaryAddress

View solution in original post

0 Kudos
6 Replies
Level 10

Hi,

there were made big changes in Discovery in NPM 10.2 which means new tables are used.

Base entry point for all discovery data is table DiscoveryProfiles which contains list of your profiles (key is <ProfileID>)

Second important table is DiscoveredNodes which contains all found nodes for all profiles (key is tuple <NodeID, ProfileID>).

Another important tables are

 DiscoveredInterfaces (key is tuple <ProfileID, DiscoveredNodeID>)
 DiscoveredPollers (key is tuple <ProfileID, NetObjectID>)
 DiscoveredVolumes (key is tuple <ProfileID, DiscoveredNodeID>)
 
Examples:

List of nodes for profile with ProfileID = 1

SELECT
  DN.IPAddress
FROM DiscoveredNodes AS DN
WHERE
  DN.ProfileID = 1

List of all nodes and related interfaces on profile with ProfileID = 1

SELECT
  DN.IPAddress,
  DI.InterfaceName
FROM DiscoveredNodes AS DN
INNER JOIN DiscoveredInterfaces AS DI
ON
  DI.ProfileID = DN.ProfileID
  AND DI.DiscoveredNodeID = DI.DiscoveredNodeID
WHERE
  DN.ProfileID = 1

I hope I help you somehow. If you were interested in tables in old discovery just let me know.

0 Kudos

I just noticed this too.  I am trying to find the table or where the contents of the discoveryprofilesearchranges table went to in 10.2.  I am using the SDK to modify the range as part of a script that does an automated discovery.

Any help much appreciated!

0 Kudos

In 10.2 we did big changes in discovery. All settings for given discovery profile are now stored in DiscoveryProfiles table. Ranges, subnets and other things are stored in new column as XML.

0 Kudos

Yes, I am looking for the pre 10.2 tables.  I am assuming there is a timestamp as to when the node was discovered so they can be filtered out of that mass table?

0 Kudos

It is very similar for versions before NPM 10.2.

Base entrypoint table is DiscoveryProfiles again.

Other related tables have prefix "Discovery". Some of them store setting for discovery which has been entered by user in discovery wizard:

DiscoverySNMPCredentialsV3
DiscoverySNMPCredentials
DiscoveryProfileSearchRanges
DiscoveryProfileSubnets
DiscoveryProfileIPBulk
DiscoveryProfileOptions
DiscoveryProfileCredentialsV3
DiscoveryProfileCredentials
DiscoveryProfileVMwareCredentials

Following tables contain discovery results:

DiscoveryVendors
DiscoverySubnets (found subnets)
DiscoveryNodes (found nodes)
DiscoveryPhysicalInterfaces (found interfaces)
DiscoveryNodeVMWare (additional information about found nodes which where recognized as VMware machines)
DiscoveryNodeStorage (found volumes)
DiscoveryNodeNames (all names for found nodes)
DiscoveryNodeFlags
DiscoveryEndPoints
DiscoveryIPAddresses (list of all IP addresses for found nodes)
DiscoveryNodeCredentialsV3 (which credentials from DiscoverySNMPCredentialsV3 can be used for given node)
DiscoveryNodeCredentials (which credentials from DiscoverySNMPCredentials can be used for given node)
DiscoverySubnetEdges
DiscoveryEdges
DiscoveryBypassEdges

There is only one relevant timestamp which is stored in table DiscoveryProfiles, column LastRun.

Examples:

List of all nodes from all discovery profiles with all IP and MAC addresses ordered by time of discovery.

SELECT
  DP.Name AS ProfileName,
  DP.LastRun AS DiscoveredAt,
  DN.Name AS NodeName,
  DIP.IPAddress AS IPAddress,
  DIP.EthernetAddress AS MAC
FROM DiscoveryNodes AS DN
INNER JOIN DiscoveryProfiles AS DP
ON
  DP.ProfileID = DN.ProfileID
INNER JOIN DiscoveryIPAddresses AS DIP
ON
  DIP.NodeID = DN.NodeID
  AND DIP.ProfileID = DN.ProfileID
ORDER BY
  DP.LastRun,
  DN.ProfileID,
  DN.NodeID

List of all nodes from all discovery profiles with primary address of node and with all found interfaces:

SELECT
  DP.Name AS ProfileName,
  DP.LastRun AS DiscoveredAt,
  DN.Name AS NodeName,
  DN.PrimaryAddress AS IPAddress,
  DI.IfxName AS InterfaceName
FROM DiscoveryNodes AS DN
INNER JOIN DiscoveryProfiles AS DP
ON
  DP.ProfileID = DN.ProfileID
INNER JOIN DiscoveryPhysicalInterfaces AS DI
ON
  DI.NodeID = DN.NodeID
  AND DI.ProfileID = DI.ProfileID
ORDER BY
  DP.LastRun,
  DN.ProfileID,
  DN.NodeID

List of all unique nodes found in all discoveries with information in which discovery was node most recently and how many discoveries found given node:

SELECT
  DN.PrimaryAddress,
  MAX(DP.LastRun) AS LastFound,
  (SELECT TOP 1 Name FROM DiscoveryProfiles WHERE LastRun >= MAX(DP.LastRun)) AS LastFoundInProfile,
  COUNT(*) As TotallyFound
FROM DiscoveryNodes AS DN
INNER JOIN DiscoveryProfiles AS DP
ON
  DP.ProfileID = DN.ProfileID
GROUP BY
  DN.PrimaryAddress

View solution in original post

0 Kudos

This worked great.  I added a WHERE clause to capture the specific scan I needed and got what I was looking for.

0 Kudos