Your records, plus what the network actually sees
Corelith takes the asset list you already have and reconciles it, continuously, against every device a collector can see on your network. Here's the whole loop.
The reconciliation loop
Two sources of truth go in. One inventory comes out, and it stays honest because the loop never stops running.
Flowchart steps
Your existing records
Imported from a CSV or your current tool. Categories, locations, people, custom fields.
What the network sees
ARP tables, switch forwarding tables, controller data. Collected passively by the appliance.
Match by MAC, then serial
MAC address first, serial number where readable. Same pass for every device, every time.
Confident matchNo matchEnrich the asset
The asset picks up IP, hostname, vendor, last-seen, and the switch port it's on. Nobody typed it.
Review queue
Unknown devices wait for a human. Promote to an asset, mark as expected infrastructure, or flag it.
Promoted or marked expectedLive inventory
One record per asset, with the network keeping it current.
Every snapshotDrift gets flagged
Wrong location, missing for weeks, new device on a known port. Flagged, not buried.
See it on your network
One appliance, no agents
Everything Corelith learns about your network comes through a single collector. Here's what it does, and what it won't do.
Passive discovery
The collector starts by listening. It reads what your switches and controller already know, and never sends traffic to the devices it's cataloging.
- ARP tables
- SNMP forwarding tables
- Controller integration
- Zero packets to endpoints
Active scanning
Where you allow it, the collector can probe a range to identify device types. You choose which subnets, how fast, and which ranges are permanently off-limits.
- Per-subnet
- Rate-limited
- Never-scan zones
- Off by default
Enrollment and transport
Each appliance enrolls to your tenant with its own credentials. Snapshots are signed on the way out and verified on arrival, and nothing listens for inbound connections.
- Per-tenant enrollment
- Signed snapshots
- Outbound HTTPS only
- No inbound ports
The appliance
A small fanless box with two gigabit ports. Plug it into a switch, power it, and it shows up in your dashboard ready to enroll. One per site is usually enough.
- Dual gigabit ports
- Fanless
- Shelf or rack
- One per site
The collector will not send a single packet to a range you haven't explicitly enabled. Never-scan zones override everything else, so fragile or sensitive equipment stays untouched even if someone misconfigures a scan later.
A typical first two weeks
No project plan required. Here's how it usually goes.
- MorningDay 1
Import your records
Upload your spreadsheet or export. Corelith proposes a field mapping, you confirm it, and your categories, locations, and people are in.
- AfternoonDay 1
Plug in the collector
Plug the collector into a switch, enroll it from the dashboard, and give it read-only SNMP access. First passive snapshot arrives within minutes.
- ReviewDay 2
Work the unknowns
Open the review queue. Most of what's there is expected infrastructure and a handful of devices nobody had written down. Promote, mark, or flag each one.
- OptionalWeek 1
Turn on active scanning where it helps
If you want device-type identification on a subnet, enable active scanning for just that range. Everything else stays passive.
- Steady stateWeek 2
Run it, and export the first audit
Check-outs, location moves, and drift flags are just part of the day now. Run your first audit export and notice how little you had to prepare.
Deployment details
What the collector needs from your network
What the collector needs from your network
A wired port with a DHCP or static address, outbound HTTPS to Corelith, and read-only SNMP access to your switches. If you use a supported controller, an API key for it.
How many collectors you need
How many collectors you need
One per site is the usual answer. A site with multiple isolated networks may want one per segment so passive discovery can see each of them.
Internet access
Internet access
Outbound only, to send snapshots to Corelith. No inbound ports are opened. If the connection drops, discovery pauses and resumes when it's back.
If the collector goes offline
If the collector goes offline
Your inventory keeps working. Last-seen timestamps stop updating and drift checks pause until the collector is back online.
Trying discovery without changing anything
Trying discovery without changing anything
Yes. Run it passive-only for a couple of weeks and see what it finds before deciding whether to enable any active scanning.