Server Scanning Reference

This document provides a comprehensive reference for Windows and Linux server discovery in Tripl-i. Server scanning uses WMI (for Windows) and SSH (for Linux/Unix) to collect deep system information, software inventory, network connections, and hardware details — building a complete Configuration Item (CI) record for each discovered device.

Overview

Server scanning is the core discovery capability. When the Nopesight Scanner agent detects open management ports during a network scan, it automatically connects using the appropriate protocol and collects comprehensive system data that flows into your CMDB.

Protocol	Target Systems	Trigger Port	Authentication
WMI	Windows Server, Windows Workstation	TCP 135, 445	Domain or local credentials
SSH	Linux, Unix, AIX, macOS	TCP 22	Username/password or SSH key

Key Benefits

Complete Hardware Inventory — Automatically discover CPU, memory, disk, network adapters, monitors, and peripherals
Software Inventory — Every installed application, version, and vendor captured with CPE matching for vulnerability tracking
Network Dependency Mapping — Active network connections mapped to identify service dependencies
User Account Audit — Local and domain user accounts discovered for access reviews
Patch Compliance — Windows hotfixes and Linux packages tracked with KB-to-CVE mapping
Database Discovery — SQL Server instances automatically detected during Windows scans
Monitor & Peripheral Tracking — External displays and USB devices tracked by serial number

How It Works

Discovery Flow

Network Port Scan
    |
    |--- Port 135/445 open ---> WMI Scanner (Windows)
    |--- Port 22 open --------> SSH Scanner (Linux/Unix)
    |
    v
Credential Lookup (per IP)
    |
    v
System Data Collection
    |
    v
Backend Processing Pipeline
    |
    +--> CI Creation/Update (Server or Workstation)
    +--> Sub-Collection Population (disks, network, software, etc.)
    +--> Relationship Building (software, database, network connections)
    +--> AI Enrichment (dependency analysis, risk scoring)

Device Type Classification

The system automatically classifies discovered devices:

Classification	Detection Criteria
Server	Server OS edition, server hardware model, domain controller role
Workstation	Desktop OS (Windows 10/11, macOS), consumer hardware model

Classification happens during backend processing based on OS name, hardware model keywords, and domain role indicators.

WMI Scanning (Windows)

Network Requirements

Port	Protocol	Purpose
135	TCP	RPC Endpoint Mapper (required)
445	TCP	SMB/CIFS for remote administration
49152-65535	TCP	Dynamic RPC ports
5985/5986	TCP	WinRM (PowerShell Remoting, optional)

Credential Requirements

Domain Account — Recommended for scanning multiple Windows devices with a single credential
Local Administrator — Required for full hardware and software collection
Minimum Permission — Remote WMI access, remote registry read, remote service query

For localhost scanning, no credentials are required — the scanner uses the current user context.

What WMI Discovers

System Information

Data Point	Description	CI Field
Computer name	NetBIOS hostname	`name`
Domain	Active Directory domain	`customFields.domain`
Manufacturer	Hardware vendor (Dell, HP, Lenovo)	`manufacturer`
Model	Hardware model name	`model`
Serial number	Service tag / serial	`serialNumber`
Currently logged-on user	Active user session	`customFields.current_user`

Operating System

Data Point	Description	CI Field
OS name	Full OS caption (e.g., "Microsoft Windows Server 2022 Standard")	`operatingSystem`
Version	OS version number	`customFields.os_version`
Build number	Windows build	`customFields.os_build`
Architecture	32-bit or 64-bit	`customFields.os_architecture`
Service pack	Service pack level	`customFields.service_pack`
Install date	OS installation date	`customFields.os_install_date`
Last boot time	Last system restart	`customFields.last_boot_time`

Processor

Data Point	Description	CI Field
CPU model	Processor name (e.g., "Intel Xeon E5-2680 v4")	`customFields.cpu_model`
Core count	Physical cores	`customFields.cpu_cores`
Thread count	Logical processors	`customFields.cpu_threads`
Clock speed	Max frequency (MHz)	`customFields.cpu_speed`
Socket count	Number of CPU sockets	`customFields.processor_count`

Memory

Data Point	Description	CI Field
Total memory	Total RAM in GB	`customFields.total_memory_gb`
DIMM details	Per-slot: capacity, speed, manufacturer, part number	Stored in raw scan data

Disk Drives

Disk information is stored in the ServerDisk sub-collection linked to the CI:

Data Point	Description
Drive letter	Volume mount point (C:, D:, etc.)
Volume name	Friendly volume label
Total size (GB)	Volume capacity
Free space (GB)	Available space
File system	NTFS, ReFS, FAT32

Physical disk details (model, interface type, media type) are stored in the ServerPhysicalDisk sub-collection.

Network Adapters

Stored in the ServerNetworkAdapter sub-collection:

Data Point	Description
Adapter name	Connection name (e.g., "Ethernet 0")
MAC address	Hardware address
IP addresses	IPv4 and IPv6 addresses with subnet masks
Speed	Link speed in Mbps
DHCP enabled	Static or dynamic configuration
DNS servers	Configured DNS servers
Default gateway	Configured gateway

Installed Software

Stored in the ServerAppsInstalled sub-collection:

Data Point	Description
Application name	Software title
Vendor	Publisher name
Version	Installed version
Install date	When it was installed

Each application is also processed through the Software Instance pipeline, which:

Creates a Software Instance CI linked to the server
Matches to the Software Catalog for normalization
Generates CPE identifiers for vulnerability matching
Links to Software Family classifications via AI analysis

Windows Hotfixes

Stored in the ServerHotfix sub-collection:

Data Point	Description
KB article	Microsoft Knowledge Base ID (e.g., KB5034441)
Description	Hotfix type (Security Update, Update, etc.)
Install date	When the hotfix was applied

Hotfixes are cross-referenced with the KB-CVE mapping database to determine which vulnerabilities are patched.

Network Connections

Stored in the ServerNetworkConnection sub-collection:

Data Point	Description
Remote IP	Destination IP address
Remote port	Destination port
Local port	Source port
Protocol	TCP or UDP
State	ESTABLISHED, LISTEN, TIME_WAIT, etc.
Process name	Application making the connection
Process ID	OS process identifier

Network connections are the foundation for dependency mapping — the AI analyzes connection patterns to identify service relationships, authentication flows, and data transfer paths between systems.

User Accounts

Stored in the ServerUserAccount sub-collection:

Data Point	Description
Username	Account name
Full name	Display name
Account type	Local or Domain
Enabled	Active or disabled

Monitors (Workstations)

External displays discovered via WMI are stored as Monitor CIs:

Data Point	Description
Manufacturer	Display manufacturer
Model	Monitor model name
Serial number	Unique serial for tracking

Monitors are linked to the workstation via a "Uses" relationship. Serial number tracking enables monitoring of display reuse across workstations over time.

Peripheral Devices (Workstations)

USB devices and docking stations stored as Peripheral CIs:

Data Point	Description
Device type	Keyboard, mouse, docking station, etc.
Manufacturer	Hardware vendor
Model	Device model

SQL Server Detection

If SQL Server is detected on a Windows server, the WMI scan automatically triggers database discovery. See SQL Server Database Discovery for details on what additional data is collected.

SSH Scanning (Linux/Unix)

Network Requirements

Port	Protocol	Purpose
22	TCP	SSH (Secure Shell) — required

Credential Requirements

Username + Password — Standard authentication
SSH Key File — Key-based authentication (more secure, recommended for production)
Sudo Access — Optional but recommended for complete hardware discovery

Scanning Modes

Mode	Access Level	What It Collects
Basic Mode	Regular user	OS info, hostname, network config, processes, packages, user accounts, network connections
Enhanced Mode	Root or sudo	All basic data plus BIOS/DMI info, disk health (SMART), hardware serial numbers, PCI devices, virtualization details, LVM volumes

What SSH Discovers

System Information

Data Point	Description	CI Field
Hostname	System hostname	`name`
OS name	Distribution and version (e.g., "Ubuntu 22.04.3 LTS")	`operatingSystem`
Kernel version	Linux kernel version	`customFields.kernel_version`
Architecture	CPU architecture (x86_64, aarch64)	`customFields.os_architecture`
Manufacturer	Hardware vendor (from DMI data)	`manufacturer`
Model	Hardware model (from DMI data)	`model`
Serial number	System serial number	`serialNumber`

Serial Number Discovery

The SSH scanner uses a multi-source approach with confidence scoring:

Source	Priority	Confidence	Method
DMI/SMBIOS (root)	1	High	`dmidecode` with sudo
Sysfs	2	High	`/sys/class/dmi/id/product_serial`
Device tree	3	Medium	`/proc/device-tree/serial-number`
CPU info	4	Medium	`/proc/cpuinfo` serial field
Hostname fallback	5	Low	Uses hostname as serial (last resort)

The confidence level is stored alongside the serial number to help assess data quality.

Virtualization Detection

The scanner automatically detects the virtualization platform:

Platform	Detection Method
VMware	DMI data, `/sys/class/dmi/id/sys_vendor`
KVM/QEMU	DMI data, `/proc/cpuinfo` hypervisor flags
Hyper-V	DMI data, kernel modules
AWS EC2	Instance metadata, DMI product name
Azure	Instance metadata, DMI product name
Google Cloud	Instance metadata, DMI product name
Xen	`/sys/hypervisor/type`
Docker/Container	`/.dockerenv`, cgroup detection

Processor

Data Point	Description
CPU model	Processor name from `/proc/cpuinfo`
Core count	Physical CPU cores
Thread count	Logical processors
Cache sizes	L2/L3 cache sizes

Memory & Disk

Data Point	Source
Total memory (GB)	`/proc/meminfo`
Disk space (total, used, free)	`df` command output
Filesystem types	Mount point details
LVM volumes	`lvs` (if available)

Network Interfaces

Stored in the ServerNetworkAdapter sub-collection:

Data Point	Description
Interface name	eth0, ens192, bond0, etc.
MAC address	Hardware address
IP addresses	IPv4 and IPv6 with CIDR notation
Interface status	Up or down

Installed Packages

Stored in the ServerAppsInstalled sub-collection:

Data Point	Source
Package name	`dpkg` (Debian/Ubuntu), `rpm` (RHEL/CentOS), `lslpp` (AIX)
Version	Package version string

Running Processes

Data Point	Description
Process ID	OS process ID
Process name	Executable name
Full command	Complete command line
User	Process owner
Executable path	Full path to binary (via `/proc/PID/exe`)

Network Connections

Stored in the ServerNetworkConnection sub-collection:

Data Point	Source
Remote IP, remote port	`netstat` or `ss` output
Local port	Listening and established connections
Protocol	TCP/UDP
State	Connection state
Associated process	`lsof` output with PID and executable

System Services (Linux)

Data Point	Description
Service name	Systemd unit name
Status	Active, inactive, failed
Enabled	Starts at boot

AIX-Specific Discovery

For IBM AIX systems, the SSH scanner collects additional data:

Data Point	Source Command
LPAR information	`lparstat` — Logical Partition details
Device attributes	`lsattr` — Hardware device configuration
System configuration	`lsconf`, `prtconf`
Installed filesets	`lslpp` — AIX package manager

What Gets Created in Tripl-i

Configuration Items

CI Type	Created When	Key Fields
Server	Server OS detected (Windows Server, Linux server)	hostname, IP, OS, manufacturer, model, serial, CPU, memory
Workstation	Desktop OS detected (Windows 10/11, macOS)	Same as Server
Software Instance	For each installed application	name, vendor, version, linked to server
Monitor	External display detected (workstations)	manufacturer, model, serial
Peripheral	USB device detected (workstations)	type, manufacturer, model
DatabaseInstance	SQL Server detected on Windows	instance name, version, edition, port

Sub-Collections

Collection	Description	Linked Via
ServerDisk	Logical disk volumes	`ci_id`
ServerPhysicalDisk	Physical disk drives	`ci_id`
ServerNetworkAdapter	Network interfaces	`ci_id`
ServerNetworkConnection	Active network connections	`ci_id`
ServerAppsInstalled	Installed software	`ci_id`
ServerHotfix	Windows KB hotfixes	`ci_id`
ServerUserAccount	Local/domain user accounts	`ci_id`
ServerMonitor	Connected monitors	`ci_id`
ServerPeripheral	Connected USB devices	`ci_id`

Relationships Created

Relationship	Source	Target	Description
Connected To	Server	Server	Network connections between systems
Installed On	Software Instance	Server/Workstation	Software installation
Instance Of	Software Instance	Software Product	Software normalization
Member Of	Software Product	Software Family	Software classification
Hosts Database	Server	DatabaseInstance	SQL Server hosting
Uses	Workstation	Monitor/Peripheral	Hardware attachment

CI Matching and Deduplication

When a device is scanned multiple times (or discovered via multiple protocols), Tripl-i matches it to existing CIs using this priority:

Serial Number — Exact match on hardware serial
MAC Address — Primary network adapter MAC
Hostname + Tenant — Case-insensitive name match within the same tenant
IP Address — Fallback matching by IP

If a match is found, the existing CI is updated with the latest scan data. No duplicate CIs are created.

Cross-Protocol Enrichment

A device can be discovered via multiple methods over time:

First discovered via vCenter as a VM (gets basic VM metadata)
Later scanned via WMI (enriches with OS details, software, network connections)
Database discovery adds SQL Server instance data
AI analysis adds relationship classifications and business impact scores

Each scan enriches the same CI without overwriting previously collected data.

Stale Connection Detection

Network connections include stale detection: if a previously seen connection no longer appears in the latest scan, it is marked as stale rather than deleted. This prevents data loss from temporary network interruptions and provides historical connection visibility.

Performance Considerations

Factor	Typical Value
WMI scan duration per host	30-90 seconds
SSH scan duration per host	15-45 seconds
Software inventory (large servers)	May add 15-30 seconds
Network connections collection	5-15 seconds

Scan duration depends on the number of installed applications, active network connections, and network latency to the target.

Security Considerations

Credentials encrypted at rest in the scanner agent's credential store
WMI uses Kerberos or NTLM authentication (domain credentials preferred)
SSH supports key-based auth — no password stored when using keys
All data transmitted over encrypted channels (HTTPS to backend)
Read-only operations — scanning never modifies target systems
Credential rotation — supports credential management integration (CyberArk, Delinea, BeyondTrust)

Next Steps

Network Scanning Overview — Understanding the full scanning pipeline
SQL Server Database Discovery — Database-specific discovery details
VMware vCenter Scanner — Virtual infrastructure discovery
Credential Management — Setting up scanning credentials
Discovery Scheduling — Automating recurring scans

Overview​

Key Benefits​

How It Works​

Discovery Flow​

Device Type Classification​

WMI Scanning (Windows)​

Network Requirements​

Credential Requirements​

What WMI Discovers​

System Information​

Operating System​

Processor​

Memory​

Disk Drives​

Network Adapters​

Installed Software​

Windows Hotfixes​

Network Connections​

User Accounts​

Monitors (Workstations)​

Peripheral Devices (Workstations)​

SQL Server Detection​

SSH Scanning (Linux/Unix)​

Network Requirements​

Credential Requirements​

Scanning Modes​

What SSH Discovers​

System Information​

Serial Number Discovery​

Virtualization Detection​

Processor​

Memory & Disk​

Network Interfaces​

Installed Packages​

Running Processes​

Network Connections​

System Services (Linux)​

AIX-Specific Discovery​

What Gets Created in Tripl-i​

Configuration Items​

Sub-Collections​

Relationships Created​

CI Matching and Deduplication​

Cross-Protocol Enrichment​

Stale Connection Detection​

Performance Considerations​

Security Considerations​

Next Steps​

Overview

Key Benefits

How It Works

Discovery Flow

Device Type Classification

WMI Scanning (Windows)

Network Requirements

Credential Requirements

What WMI Discovers

System Information

Operating System

Processor

Memory

Disk Drives

Network Adapters

Installed Software

Windows Hotfixes

Network Connections

User Accounts

Monitors (Workstations)

Peripheral Devices (Workstations)

SQL Server Detection

SSH Scanning (Linux/Unix)

Network Requirements

Credential Requirements

Scanning Modes

What SSH Discovers

System Information

Serial Number Discovery

Virtualization Detection

Processor

Memory & Disk

Network Interfaces

Installed Packages

Running Processes

Network Connections

System Services (Linux)

AIX-Specific Discovery

What Gets Created in Tripl-i

Configuration Items

Sub-Collections

Relationships Created

CI Matching and Deduplication

Cross-Protocol Enrichment

Stale Connection Detection

Performance Considerations

Security Considerations

Next Steps