Skip to content

Unknown Hosts

Purpose

Unknown Hosts lists the flow endpoints that match no device in the Clarity Transform CMDB. Rather than dropping them, Clarity records each one with a first-seen date, a last-seen date and an observation count, so gaps in discovery coverage are visible. A device record is not created for them. The on-screen subtitle reads: "Devices seen in traffic evidence that have no matching CMDB device record - a discovery hygiene queue, not something inference groups."

Where the rows come from

The rows are written by Run inference on Candidate Applications. Run grouping on the same page reports how many flows it left out because their IP address is not in inventory, and running inference lists those addresses here.

Where to find it

Discover → Application Inference → Unknown Hosts. The page header is Unknown Hosts.

What you see

Columns

  • Address
  • Status: New or Dismissed; values seen: New.
  • Observation Count
  • First Seen
  • Last Seen

Actions

The grid uses the standard toolbar: Create New, Edit, Remove selected, Clear selection, Reload table data, Enable spreadsheet editing, Export CSV and Import CSV.

Each row has a View Details action (the eye icon).

Form

Create New opens the Create new entry form. Edit opens the Edit entry form for the selected row, with the same fields filled in. The fields, in order:

  • Address: text. Help: "A flow endpoint that never resolved to a known device - not auto-created as one."
  • Status: New or Dismissed.
  • Observation Count: text.
  • First Seen: a date.
  • Last Seen: a date.

The footer has Cancel and Save.

Filters

Each column has a filter row, and the grid has a Search: box and a page-size selector (10, 25, 50 or All entries per page).

The grid remembers its Search: text, column filters, sort order and page size between visits. If the grid shows fewer rows than you expect, clear the Search: box and the filter row.

How to

Work the unknown hosts

  1. Run inference if you have not done so since the last discovery: select Run inference on Candidate Applications.
  2. Go to Discover → Application Inference → Unknown Hosts.
  3. Sort the grid by Observation Count. A high count means the address takes part in the estate's traffic persistently, not once.
  4. If the address belongs in the migration, extend discovery to include it, so that discovery creates the device record.
  5. If it is out of scope, dismiss it: select its row, select Edit, set Status to Dismissed, and select Save.

Dismiss only addresses you have identified. Dismissing an unknown address turns a visible coverage gap into an invisible one.

  • Integrations: extend discovery to cover an address.
  • Device: the Device records that endpoints are matched against.
  • Candidate Applications: where inference is run. Inference does not group unknown hosts.