Skip to content

Device Suggestions

Purpose

Device Suggestions is the Clarity Transform review queue for application membership. Inference proposes devices that belong to an application, and a consultant accepts or suppresses each suggestion. Nothing is written to the CMDB until you accept one. The on-screen subtitle reads: "Stage 2 of application inference: devices that belong to no confirmed application but talk to one that does. Discovered services is the supporting evidence - technology signals from a port lookup, not applications."

This screen covers devices that talk to a confirmed application, so start at Candidate Applications and promote applications first.

Where the rows come from

The suggestions and discovered services are written by Run inference on Candidate Applications. This page has no run button. Because suggestions are worked out against confirmed applications, run inference again after you promote applications, then review the new rows here.

Where to find it

Discover → Application Inference → Device Suggestions. The page header is Device Suggestions.

What you see

Tabs

  • Device Suggestions: the membership suggestions.
  • Discovered Services: the supporting evidence, services found from a port lookup.

Neither tab has a create or edit form, and neither has a run button. The Device Suggestions tab is shown first. Both tabs open filtered to Pending.

Device Suggestions tab

Filter buttons: Columns, Pending, Accepted, Suppressed and All. Columns shows or hides columns.

Columns:

  • Application Name: the confirmed application the device is proposed to belong to.
  • Suggested Device Name: the device proposed as a member.
  • Trigger Port
  • Trigger Protocol: values seen: HTTPS, TCP.
  • Status: values seen: Pending.
  • Observation Count
  • Last Seen
  • Evidence: values seen: Observed.
  • Actions: the row actions below.

Hidden by default, and shown with Columns: First Seen, Id, Created On, Created By, Last Updated and Last Updated By.

Row actions:

  • Accept - write runs-on relationship: opens the Accept Membership dialog, with the buttons Cancel and Accept. Accepting writes a runs-on relationship between the device and the application to the CMDB and sets the row to Accepted.
  • Suppress - never recreate: opens the Suppress Membership Suggestion dialog, with the buttons Cancel and Suppress. Suppressing sets the row to Suppressed, and later inference runs do not recreate it.

The row actions are shown only on Pending rows. An Accepted or Suppressed row shows a dash, so a decision cannot be reversed from this page.

Discovered Services tab

Filter buttons: Columns, Pending, Promoted, Suppressed and All.

Columns: Device Name, Destination Port, Protocol, Display Name, Suggested App Name, Status, Observation Count, Last Seen, Source and Actions.

Status is Pending, Promoted or Suppressed. There is no promote action: a discovered service is a technology signal from a port lookup, not an application. Applications come from promoting a group on Candidate Applications.

Row actions:

  • On a Pending row, Suppress - never recreate, which opens the Suppress Suggestion dialog, with the buttons Cancel and Suppress.
  • On a Promoted row, Suppress, which opens the same dialog.
  • A Suppressed row shows a dash.

Evidence

The Evidence value says what kind of signal a suggestion rests on. The kinds are set on Evidence Sources:

  • Observed: observed traffic between the endpoints.
  • Permitted: a firewall permit. It does not mean the traffic ever happened.

Messages

After Accept or Suppress, the dialog closes and the grid reloads. There is no success message: with the Pending filter on, the decided row leaves the list. If the action fails, an error message reads "Error:" followed by the reason, or "Error: Accept failed." or "Error: Suppress failed." when no reason is given.

Filters

The grid remembers its Search: text, column filters, sort order and page size between visits. If the grid shows fewer rows than you expect, clear the Search: box and the filter row.

How to

Review the device suggestions

  1. If you have promoted applications since the last run, first select Run inference on Candidate Applications.
  2. Go to Discover → Application Inference → Device Suggestions. The Device Suggestions tab opens.
  3. The tab opens filtered to Pending, the suggestions still to decide. Select All to see decided rows too.
  4. For each suggestion, read Evidence, Trigger Port, Observation Count and Last Seen. Observed traffic on a recognisable service port is stronger evidence than a firewall permit with no observed traffic.
  5. To accept the device as a member, select Accept - write runs-on relationship. The Accept Membership dialog opens. Select Accept, or Cancel.
  6. To reject it, select Suppress - never recreate. The Suppress Membership Suggestion dialog opens. Select Suppress, or Cancel.

Suppress a wrong suggestion rather than leaving it pending, so that the decision is recorded. Accepting and suppressing cannot be undone from this page, so check the evidence first.

Suppress a discovered service

  1. Select the Discovered Services tab.
  2. On the service's row, select Suppress - never recreate. The Suppress Suggestion dialog opens.
  3. Select Suppress, or Cancel.