This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Repository for Network Sonar Discovery Results

FormerMember
FormerMember

Hello all,

I am trying to build a custom report using Report Writer to pull the data found by the Network Sonar Discovery Results.  I would like to audit those nodes found, but I need it in structured data rather than the screenshot that is the 'Export to PDF' option on the web console.

Again, I am looking for the table that stages the discovered data before you choose whether to import or ignore those results.

Any help would be appreciated.

Thanks,

J

  • Hi,

    there were made big changes in Discovery in NPM 10.2 which means new tables are used.

    Base entry point for all discovery data is table DiscoveryProfiles which contains list of your profiles (key is <ProfileID>)

    Second important table is DiscoveredNodes which contains all found nodes for all profiles (key is tuple <NodeID, ProfileID>).

    Another important tables are

     DiscoveredInterfaces (key is tuple <ProfileID, DiscoveredNodeID>)
     DiscoveredPollers (key is tuple <ProfileID, NetObjectID>)
     DiscoveredVolumes (key is tuple <ProfileID, DiscoveredNodeID>)
     
    Examples:

    List of nodes for profile with ProfileID = 1

    SELECT
      DN.IPAddress
    FROM DiscoveredNodes AS DN
    WHERE
      DN.ProfileID = 1

    List of all nodes and related interfaces on profile with ProfileID = 1

    SELECT
      DN.IPAddress,
      DI.InterfaceName
    FROM DiscoveredNodes AS DN
    INNER JOIN DiscoveredInterfaces AS DI
    ON
      DI.ProfileID = DN.ProfileID
      AND DI.DiscoveredNodeID = DI.DiscoveredNodeID
    WHERE
      DN.ProfileID = 1

    I hope I help you somehow. If you were interested in tables in old discovery just let me know.

  • FormerMember
    0 FormerMember in reply to tomas.mrkvicka

    Yes, I am looking for the pre 10.2 tables.  I am assuming there is a timestamp as to when the node was discovered so they can be filtered out of that mass table?

  • It is very similar for versions before NPM 10.2.

    Base entrypoint table is DiscoveryProfiles again.

    Other related tables have prefix "Discovery". Some of them store setting for discovery which has been entered by user in discovery wizard:

    DiscoverySNMPCredentialsV3
    DiscoverySNMPCredentials
    DiscoveryProfileSearchRanges
    DiscoveryProfileSubnets
    DiscoveryProfileIPBulk
    DiscoveryProfileOptions
    DiscoveryProfileCredentialsV3
    DiscoveryProfileCredentials
    DiscoveryProfileVMwareCredentials

    Following tables contain discovery results:

    DiscoveryVendors
    DiscoverySubnets (found subnets)
    DiscoveryNodes (found nodes)
    DiscoveryPhysicalInterfaces (found interfaces)
    DiscoveryNodeVMWare (additional information about found nodes which where recognized as VMware machines)
    DiscoveryNodeStorage (found volumes)
    DiscoveryNodeNames (all names for found nodes)
    DiscoveryNodeFlags
    DiscoveryEndPoints
    DiscoveryIPAddresses (list of all IP addresses for found nodes)
    DiscoveryNodeCredentialsV3 (which credentials from DiscoverySNMPCredentialsV3 can be used for given node)
    DiscoveryNodeCredentials (which credentials from DiscoverySNMPCredentials can be used for given node)
    DiscoverySubnetEdges
    DiscoveryEdges
    DiscoveryBypassEdges

    There is only one relevant timestamp which is stored in table DiscoveryProfiles, column LastRun.

    Examples:

    List of all nodes from all discovery profiles with all IP and MAC addresses ordered by time of discovery.

    SELECT
      DP.Name AS ProfileName,
      DP.LastRun AS DiscoveredAt,
      DN.Name AS NodeName,
      DIP.IPAddress AS IPAddress,
      DIP.EthernetAddress AS MAC
    FROM DiscoveryNodes AS DN
    INNER JOIN DiscoveryProfiles AS DP
    ON
      DP.ProfileID = DN.ProfileID
    INNER JOIN DiscoveryIPAddresses AS DIP
    ON
      DIP.NodeID = DN.NodeID
      AND DIP.ProfileID = DN.ProfileID
    ORDER BY
      DP.LastRun,
      DN.ProfileID,
      DN.NodeID

    List of all nodes from all discovery profiles with primary address of node and with all found interfaces:

    SELECT
      DP.Name AS ProfileName,
      DP.LastRun AS DiscoveredAt,
      DN.Name AS NodeName,
      DN.PrimaryAddress AS IPAddress,
      DI.IfxName AS InterfaceName
    FROM DiscoveryNodes AS DN
    INNER JOIN DiscoveryProfiles AS DP
    ON
      DP.ProfileID = DN.ProfileID
    INNER JOIN DiscoveryPhysicalInterfaces AS DI
    ON
      DI.NodeID = DN.NodeID
      AND DI.ProfileID = DI.ProfileID
    ORDER BY
      DP.LastRun,
      DN.ProfileID,
      DN.NodeID

    List of all unique nodes found in all discoveries with information in which discovery was node most recently and how many discoveries found given node:

    SELECT
      DN.PrimaryAddress,
      MAX(DP.LastRun) AS LastFound,
      (SELECT TOP 1 Name FROM DiscoveryProfiles WHERE LastRun >= MAX(DP.LastRun)) AS LastFoundInProfile,
      COUNT(*) As TotallyFound
    FROM DiscoveryNodes AS DN
    INNER JOIN DiscoveryProfiles AS DP
    ON
      DP.ProfileID = DN.ProfileID
    GROUP BY
      DN.PrimaryAddress

  • FormerMember
    0 FormerMember in reply to tomas.mrkvicka

    This worked great.  I added a WHERE clause to capture the specific scan I needed and got what I was looking for.

  • I just noticed this too.  I am trying to find the table or where the contents of the discoveryprofilesearchranges table went to in 10.2.  I am using the SDK to modify the range as part of a script that does an automated discovery.

    Any help much appreciated!

  • In 10.2 we did big changes in discovery. All settings for given discovery profile are now stored in DiscoveryProfiles table. Ranges, subnets and other things are stored in new column as XML.