Reconcile discovery against your own CMDB

short · 45 min · Objective 1.4

Task

Compare what you recorded against what is actually there, and classify every difference. The gap between the two is the lesson.

Steps

  1. Run at least two independent discovery sources and write their output to lab/discovered.csv with header id,type,source.
  2. Produce lab/recon.csv with header id,type,in_cmdb,in_discovery,class joining the two on identifier.
  3. Set class to one of observed-not-recorded, recorded-not-observed or attributes-disagree, leaving matching rows blank.
  4. For every observed-not-recorded row, add it to lab/cmdb.csv with an owner -- this is the remediation, not the finding.
  5. Write lab/recon-finding.md stating your coverage: assets recorded, assets observed, and the count of each class. Include the sentence 'coverage is N of M' with real numbers.

Verify

awk -F, 'NR>1 {print $5}' lab/recon.csv | grep -v '^$' | sort | uniq -c
awk -F, 'NR>1 {n++} END {print n" reconciled row(s)"}' lab/recon.csv
grep -Ec 'coverage is [0-9]+ of [0-9]+' lab/recon-finding.md
awk -F, 'NR>1 {print $3}' lab/cmdb.csv | grep -c .

At least one row in each of two classes, and the coverage sentence present with real numbers. A reconciliation with no differences means the discovery sources share a blind spot -- add one that does not, such as the identity provider.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.