--- title: Discovery and maps slug: discovery-and-maps docTags: createdAt: 2026-10-23T17:17:02.293Z --- ## Organization structure ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/Kwq6GdD2Tf5NeQoO3n2uj_image.png" size="67" isUploading="false" width="672" height="423" darkWidth="672" darkHeight="423" showCaption="false"} Screen: Organization structure The organization structure holds two trees that group everything in Hive: **Locations** (Company › Site ›Building › Floor › Room) and **Departments** (for example Board › Finance › Accounts payable, with a cost center). Machines fall into place by themselves, and the structure is used by the physical map, deployment targets and who sees each item in the Store. It is in **Discovery › Structure**. ### What you can do here Create the company and its sites with **New company or site**, and build the tree with **Add inside**. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/lWLeoMo6zcGGggf5ebI50_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} Create departments with **New department**, linked to directory names and OUs. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/2gXuVRvP3yY0wR3n8Jmy7_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} **Edit** a node (name, code, where it is inside, linking tags) or **Remove** it. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/KJeyN_zmpOTI8NTx8bQLJ_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} Switch between **List** and **Map** to see the tree. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/DhJpffyUcfwVKRZ8z67Hf_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} See how many machines are in each node (**Machines**, with "n directly") and open them in the inventory. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/qm2akY-AiAQc_msfMSIcC_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} ### Step by step: build the locations tree 1. Open **Discovery › Structure**, tab **Locations**. 2. Click **New company or site** (needs assets\:write ). Choose the **Kind** (Company or Site), fill **Name **and, optionally, **Code**, and click **Save**. 3. On a row, click **Add inside** to create the level below. Each level only goes inside a higher one: buildings, floors and rooms go inside a site (a floor can go straight inside a site, or inside a building). 4. To link machines by their origin, edit a location and fill **Link automatically by tag**, or choose one in **Or pick a tag already in use** (the list shows how many machines have each tag). 5. To move a node, **Edit** it and change **Inside**. A site also becomes the site used for time zone, maintenance window and distribution point by deployments, and sites that already existed show up as tree nodes. ### How a machine lands in the right place Location, from the strongest rule to the weakest: 1. **Linking tag**: a machine with one of the location's tags lands there (the deepest level wins). Useful tags are the scan tags (step 5 of the scan wizard or "Descoberto por: ..."), the agent install token tags and Agente: \ , Cluster: \ , Nuvem: \ and Hipervisor: \ . 2. **Rack**: the room, floor or building where its rack is placed. 2. **Switch port**: the location of the switch it is plugged into. 3. **Subnet**: the site of its subnet (registered in **Assets › Tags › Tags by origin**, field **Site**). Department: the department of the machine's main user in the directory (the department name or one of its **Names in the directory**), otherwise the department whose **OUs** match the computer account's OU path. A choice made by hand on the machine (panel **Where it is** › **Change**) wins over every rule; **Automatic (by the rules)** goes back to the rules. The machine inherits the tags Empresa , Localidade , Prédio , Andar , Sala and Departamento with the names of its path; when it changes rack, port, network or user, they change by themselves. The structure is applied when a scan ends, when the agent sends inventory, every 10 minutes and whenever the tree changes. **Worked example: site "São Paulo HQ" with two floors and its subnet** 1. **New company or site**, **Kind** Company, **Name**Aurora S.A. , **Save**. 2. On Aurora S.A. , **Add inside**, **Kind** Site, **Name**São Paulo HQ , **Code**SPO , **Save**. 3. On São Paulo HQ , **Add inside**, **Kind** Floor, **Name**Floor 1 , **Save**; repeat for Floor 2 . 4. Open **Assets › Tags**, tab **Tags by origin**, **New subnet**: **Network (CIDR)**10.10.0.0/16 , **Name**SP HQ , **Site**São Paulo HQ (the same name links to the same site), **Register and apply tags**. 5. Back in **Structure**, São Paulo HQ shows, for example, **Machines** 312: every machine with an address in 10.10.0.0/16 landed there and got the tags Empresa: Aurora S.A. and Localidade: São Paulo HQ . 6. To put machines on a floor: edit Floor 2 and, in **Link automatically by tag**, add Agente: SP-FLOOR2 (the token used to install the agents on that floor). After saving ("Saved; the machines were placed again."), those machines move to Floor 2 and get Andar: Floor 2 . São Paulo HQ still counts them, now with "(n directly)" for the ones that are only on the site. 7. A notebook that belongs to Floor 1 but was installed with the wrong token: open it, panel **Where it is**, **Change**, choose Floor 1 . It now shows "chosen by hand". ### Worked example: Finance department from the directory 1. Tab **Departments**, **New department**, **Name**Finance , **Cost center**CC-2100 , **Names in the directory**Financeiro, FIN , **OUs**OU=Financeiro , **Save**. 2. Machines whose main user has the "department" attribute Financeiro (or whose computer account is under OU=Financeiro ) land in Finance and get the tag Departamento: Finance . 3. Inside Finance , **Add inside**Accounts payable . In **Assets › All assets**, the filter **Department **Finance also includes Accounts payable . ### Where the structure is used **Deployments, patches and playbooks**: pick a node and every machine in its subtree is included. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/CVoY-HTQKI-C0ADNT6OGp_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} **Store**: who sees each item. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/HlE_s6XOLCoGfbpQt70ww_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} **Physical map**: devices grouped by their location path. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/ITx1PWZtQSGdgww8wtYtV_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} **Racks**: each rack is placed in a room, floor or building. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/x2o0BgSb72fkuvFXU7f5Z_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} **Inventory**: the **Location** and **Department** filters include the subtree. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/tEP9pkOqDgGTNleck6edi_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} ### Pitfalls and limits Creating, editing and removing nodes needs assets\:write . ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/O4RnL34kxNxwprOQi246S_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} **Remove** also removes everything inside; the machines go back to the automatic rules. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/bP7S1bSAMq5BM5OtnQ9J-_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Names must be unique among siblings ("There is already a location with this name here."). ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/hKhoDTGqS3Fnn7lGYw9g6_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} A tag can have up to 200 characters. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/VLtAVdqFh8AeioahDyiZZ_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Only locations have linking tags; departments use directory names and OUs. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/rNL2DPfUR-P1z-r4-YB-z_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} ### Related Tags and groups ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/SQN3rCfmOXzRja9Cyo99r_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Discovery ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/cIE1_mj64LLMtwbj0kvg__image.png" size="10" isUploading="false" width="5" height="4" showCaption="false"} Network map ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/2gBFJaFbpmyfOZ9RS4bRr_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} Deployments ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/xY00t7TdQeR9_zxAiKd7I_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} Inventory ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/2G4BCaVihnrbbvpoANIf1_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} ### Discovery area ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/GMpw9l0cyehfuRdSYZOaP_image.png" size="67" isUploading="false" width="672" height="426" darkWidth="672" darkHeight="426" showCaption="false"} Screen: Discovery area (1/3) ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/MzfswBJVzTPtXGsBLiBup_image.png" size="67" isUploading="false" width="672" height="423" darkWidth="672" darkHeight="423" showCaption="false"} Screen: Discovery area (2/3) ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/BlFkO6J3-Cje1GTXslmKJ_image.png" size="67" isUploading="false" width="672" height="426" darkWidth="672" darkHeight="426" showCaption="false"} Screen: Discovery area (3/3) In **Discovery › Discovery** you scan networks from a collector to find what has no agent: workstations, servers, printers, cameras, phones and network devices. Each scan says which ranges, methods, credentials, collector, intensity, tags and schedule it uses; each run shows what is new, what changed, what is gone and what still has no agent. The passwords, keys and SNMP communities live in the **Credential vault** (**Integrations › Credentials**, also a tab of Discovery). Nothing opens from the internet inwards: the collector only makes outbound calls. Creating and running scans needs **Manage agents**. ### What you can do here **Scans**: see each scan with its scope, methods, last run (answered, new, without agent) and next run; **Run now**, **Edit** or remove it. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/FVcQubGxESfhVde62AbPJ_image.png" size="10" isUploading="false" width="5" height="4" showCaption="false"} **New scan**: the seven-step wizard with an estimate before saving. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/bf7RH4SbCsFyBdOjXe7Yw_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} **Credential vault**: create, edit, test and remove WinRM, SSH and SNMP credentials; see how many scans use each one. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/S0O5uX0v6MFLNCAOGtgl-_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} **Run view**: follow a run live, compare it with the previous one, read the errors and install the agent on Windows machines found without it. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/e-iz2WUgHVGHk5Z1leG_r_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} In the asset detail, **Discovered by** shows which method, collector and scan brought each piece of data. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/ltOzDaDFMOXTIyQQrYaWy_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} ### Creating a scan **Scope.** Mark **Known networks** (the ones registered and the ones seen by the agents, with their asset count) or add **Other ranges** as a network (CIDR, like 10.20.0.0/24 ) or **From**/**To**. Under **Exclusions**, remove sensitive ranges such as industrial automation (OT) or medical equipment. Up to 65,536 addresses per scan. **Methods.** Turn on what this scan uses: ICMP (ping), ARP (MAC on the same network), common TCP ports (30 ports), TLS certificates, NetBIOS (Windows name), mDNS / SSDP (printers, TVs, IoT), WMI / WinRM (Windows inventory without agent, Windows 2008 R2 included), SSH (Linux, Unix and appliances), SNMP v1/v2c/v3 (switches, routers, printers: ports, VLANs and the MAC table), LLDP and CDP (neighbors, read by SNMP). NetFlow / sFlow / IPFIX is not a scan method: the collector receives flows all the time. **Credentials.** For each method with credential (WinRM, SSH, SNMP), tick one or more credentials of the vault, or create a **New credential** right here. The password stays in the vault and only goes to the collector with the task. **Collector and intensity.** Choose the collector inside the network and the intensity: **Light** (50 packets/s, 32 at a time), **Normal** (200 packets/s, 128 at a time) or **Fast** (1000 packets/s, 256 at a time, asks you to confirm). The scan pauses by itself if the network gets slow. Optionally, **Run only in this time window **(for example 22:00 to 06:00). **Origin tags.** Every asset found gets the tag Descoberto por: \ · \ · \ (always with this name, whatever the language) and the tags you add here (press Enter after each one). **Schedule.Only when I ask**, **Every day** or **Some days of the week**, at a time in your time zone. **Run now, after saving** starts the first run immediately. **Review.** Give the **Scan name** and check the estimate: addresses, estimated duration and load on the network, with warnings for fast intensity, credentials and large scopes. Then **Save scan**. ### Credential vault In **Integrations › Credentials**, **New credential** asks for a **Name**, the **Type** and: **WMI / WinRM**: user as DOMAIN\user or user\@domain , password, **WinRM transport** HTTPS (5986) or HTTP (5985). ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/y42zgXGw0fRxPV5YWX_6y_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} **SSH**: user, password and port if it is not 22. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/eW97T71iOc0UKsFd-MFre_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} **SNMP**: the version — v1 or v2c with the **Community**, or v3 with the **SNMP v3 user**, the **Security level** (authPriv, authNoPriv or noAuthNoPriv), the **Authentication protocol** (SHA-1 to SHA-512, or MD5) and password, and the **Privacy protocol** (AES-128, AES-192, AES-256 or DES) and password (blank uses the authentication password). ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/hLa3hET_jwOQ6HuhOFMTx_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} **Only on these networks (optional)**: limit where the credential may be used, like 10.20.0.0/16 . ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/WmhlpdmryXEMwqxNxtCSH_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} **Test** runs through a collector against one machine in three steps — **Reach the port**, **Sign in**, **Collect** —and shows what the method brings (system, host name, programs, services). Editing a credential updates every scan that uses it; secrets are never shown again. ### Reading a run The run page shows the state (**Waiting for the collector**, **Running**, **Done**, **Failed**, **Cancelled**), the progress in addresses and the figures **Answered**, **New**, **Changed**, **Gone** (seen in the previous run and not in this one), **Without agent** and **Pauses (slow network)**. The tabs list the devices of each kind with IP, name, MAC, manufacturer, system, type, methods and open ports, and **Errors** explains each failure (credential refused, closed port). In **Without agent**, select Windows machines and click **Install agent**: the scan's collector installs it by WinRM with a vault credential. **Cancel run** stops it; **Runs** lists the history. ### How discovery recognizes a known device A device found by a scan goes into the inventory through the same reconciliation as the agent. From the most reliable to the least: 1. Serial number or hardware UUID read from inside the device (WinRM, SSH). 2. MAC addresses the device reports itself (inventory, NetBIOS). 3. The name the device reports. 4. The IP address — a device with an agent first, then the one seen most recently. 5. Last resort: the MAC from the collector's ARP table, and only when exactly one device has it. ARP and DNS tables that nobody cleans keep MACs and IPs of devices that are gone, so Hive treats them carefully: an ambiguous ARP MAC never merges two records, an ARP MAC that already belongs to another device is not copied, and names come only from what the device reports (no reverse DNS). When an IP now answers for a device, it is removed from the other records without agent that still kept it. If the machine already has an agent, discovery only records that it saw it. **Worked example: weekly scan of 10.10.0.0/16 with SNMP v3, SSH and WinRM** 1. In **Integrations › Credentials**, create three credentials and test each one against a known device: 2. "SNMP core" — SNMP v3, user hive-ro , authPriv, SHA-256, AES-128, tested against the switch 10.10.0.2 . 2. "SSH Linux" — SSH, user hive-scan , port 22, tested against 10.10.20.15 . 3. "WinRM CORP" — WMI / WinRM, CORP\svc-hive-scan , HTTPS (5986), tested against 10.10.4.20 . 5. Open **Discovery › Discovery** and click **New scan**. 4. **Scope**: add 10.10.0.0/16 and the exclusion 10.10.250.0/24 (factory automation). 5. **Methods**: keep ICMP, ARP, ports, TLS, NetBIOS and mDNS; turn on WMI / WinRM, SSH, SNMP, LLDP and CDP. 6. **Credentials**: tick "WinRM CORP", "SSH Linux" and "SNMP core". 7. **Collector and intensity**: COL-SP-01 , **Normal**, time window 22:00 to 06:00. 8. **Origin tags**: Office SP . 9. **Schedule**: **Some days of the week**, only Sat, at 22:00. 10. **Review**: name "SP weekly". The estimate shows 65,280 addresses, about 247 min, 200 packets/s · 102 kbit/s, and the warnings for credentials and a large scope. **Save scan**. ### Worked example: review a run Sunday morning, open the scan's last run from **Scans** (click the entry under **Last run**). 1. The figures say Answered 1,834 · New 57 · Changed 112 · Gone 9 · Without agent 41 · Pauses 2. The two pauses happened when the network got slow; the collector lowered the rate by itself. 2. **New**: 57 devices, among them 12 IP cameras found by ports and TLS, and two switches read by SNMP. They are now assets with the tags Descoberto por: … and Office SP . 3. **Gone**: 9 devices seen last week and not now — check whether they were retired. 4. **Errors**: 10.10.20.31 · SSH — the credential was refused . Fix the account on that server or the credential in the vault. 5. **Without agent**: 41 computers, 33 of them Windows. Tick the 33, click **Install agent (33)**, choose "WinRM CORP" and confirm. The new agents show up in **Assets › Agents**. ### Worked example: the ARP rule in practice Two notebooks already share the MAC 00:1a:2b:3c:4d:5e in the inventory (an old USB network adapter). The scan sees 10.10.8.12 with only that MAC, from the ARP table. Hive does not choose one of them: the device enters as a new asset by its IP, and the MAC is not copied to it. WS-0231 (Windows without agent, read by WinRM) received 10.10.4.20 by DHCP; that IP was still in the record of WS-0198 , also without agent. The scan matches WS-0231 by its serial number, adds 10.10.4.20 to it and removes the IP from WS-0198 . If WS-0198 had an agent, its addresses would be left alone. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/0tp1LHCZHgboCMNgOJMSS_image.png" size="10" isUploading="false" width="5" height="4" showCaption="false"} ### Pitfalls and limits Up to 65,536 addresses per scan; split larger scopes. The exclusions cannot remove every address. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/0IMboQ5OGSYNdR91wDX_a_image.png" size="10" isUploading="false" width="5" height="4" showCaption="false"} A scan does not start again while its previous run is still waiting or running. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/ITAfMo5eBwtDnODe-FAwy_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} **Fast** can slow the network down and asks for confirmation; prefer **Normal** with a time window. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/gP6L0QlAlt26khMW2uAH5_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Without an online collector there is nothing to choose in step 4: install one first. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/ySsgzpBZcv7-BHSZUSrDs_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Scan names are unique (up to 80 characters). ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/9JWC6g6PRdwPPyOqQ14KG_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Installing from a run takes up to 500 machines at a time and only Windows machines still without agent. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/IoqPwWqik4tD109yxo3ma_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Removing a scan removes its history; the assets it found stay in the inventory. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/h6ZykwwNVJ2rXLzNRYKjB_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} ### Related Network and topology ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/9p6B4l1Xnpkql0qNJVRbY_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Rolling out the agent ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/6MYR9ljLWOgVzxkA_Syy0_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} Step by step: create a collector ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/xxKes7nhbCdyHU9F1FQwr_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} Agents and collectors ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/A9BWKT2k9oS0QYKk-X1nq_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} ### Network and topology ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/f6Tv4wWXiEJE_Xw74kl93_image.png" size="67" isUploading="false" width="672" height="426" darkWidth="672" darkHeight="426" showCaption="false"} Screen: Network and topology **Maps › Network map** shows the network as Hive reads it: switches, routers and printers read by SNMP, the links between them found by LLDP and CDP, which device is plugged into each port (from the switch MAC table), the traffic of each port and the racks and rooms. It has three tabs: **Physical map**, **Ports **and **Racks**. The data comes from discovery scans with SNMP turned on; flows (NetFlow, sFlow, IPFIX) and the agents' own connections add the traffic between machines. ### What you can do here **Physical map**: see the connection map from the Internet down to each machine, filter by **Location**, **Highlight VLAN** and click any element to light its path to the Internet. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/lyHSUTaWfHkTukEwl1fum_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} **Ports**: choose a device and see the front panel of the switch, each port with state, speed, VLAN, neighbor, connected devices, traffic in Mb/s and the link use in the last 24 hours. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/ELLZ6GP9PKklw9-qPSIW2_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} **Racks**: create racks with room, units and place in the structure, and see how many devices each one has. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/c-9VppTZqUFEgW8G-y8xh_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} On each asset (Hardware tab, **Physical network**): the port where it is plugged, the port history, its rack and unit, the path to the Internet and the dependency map. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/XtujEyixjglfQS3jZewdq_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} ### Reading switches by SNMP Create an SNMP credential in **Integrations › Credentials** (community for v1/v2c, or user, authentication and privacy for v3) and turn on SNMP, LLDP and CDP in a scan with that credential. On each read, the collector brings the ports (state, speed, VLAN), the VLAN names, the MAC table and the LLDP/CDP neighbors. A device is placed on a port by the MAC table, ignoring uplinks (ports with a neighbor or with more than 8 MACs). It then carries the tags Switch: \ and Porta: \ · \ ; when it moves, the tags change by themselves and the move goes to its port history. ### Physical map The **Connection map** is a tree: the Internet at the top, each switch hanging from its uplink (the fastest LLDP/CDP neighbor), machines on the port where they are plugged (with port and VLAN) and VMs dashed under their host. A thick line is an aggregated link (**LAG ×N** with the summed speed); dashed is a link down or virtual; red has errors; neighbors Hive does not read yet are grouped apart. Moving dots show traffic toward the Internet. Devices are grouped by their place in the structure; **Location** shows only that place, what is below it and the path to the exit, and devices whose ports show new errors since the last read are highlighted. **Highlight VLAN** fades every device that does not carry the chosen VLAN. ### Ports and traffic In **Ports**, choose the **Device**. The **Front panel of the switch** draws the ports as on the device: green up, grey down, orange with new errors and a blue border on the uplink; hover for the port, speed, VLAN and who is connected. Below, each port shows its state, neighbor, the devices plugged into it and **Traffic** (↓ in · ↑ out in Mb/s and % of the link), computed by comparing the byte counters of two SNMP reads. Clicking the rate opens **Link use, last 24 h (SNMP counters)**. ### Racks and placement In **Racks**, **New rack** asks for the name, the **Room**, the **Units (U)** (1 to 60, default 42) and the **Place in the structure (room, floor or building)**. On a device (Hardware tab, **Physical network**), choose the **Rack** and **Unit**: it inherits the tags Rack: \ and Sala: \ . Deployments, patches and playbooks can target a switch, a rack or a room through these tags. ### Flows between machines The collector always listens for flows: point switches, routers and firewalls to its IP — NetFlow v5/v9 and IPFIX on UDP 2055, sFlow v5 on UDP 6343 (each sample counts the frame size × the sampling rate). Agents also report the connections of their own machine (who talked to whom, on which port), with nothing to set up on the switch; when both ends have an agent, only the server side counts, so nothing is doubled. The flows are summed per minute and feed the logical map and the service map. **Worked example: find where a notebook is plugged and follow its path** 1. In **Integrations › Credentials**, create "SNMP core" (v3, user hive-ro , authPriv, SHA-256, AES- 128) and test it against 10.10.0.2 . 2. In **Discovery**, edit the scan "SP weekly", turn on SNMP, LLDP and CDP with "SNMP core" and click **Run now**. 3. After the run, open **Maps › Network map**. The core switch SW-CORE-01 hangs from the Internet; SW-3F-01 hangs from it by a **LAG ×2 · 2 Gb/s** line. 4. Search the notebook NB-SALES-12 in **Assets** and open its Hardware tab: **Plugged into** says SW-3F-01 · Gi1/0/14 , VLAN 30. The asset has the tags Switch: SW-3F-01 and Porta: SW-3F-01 · Gi1/0/14 . 5. **Path to the internet (by the uplinks)** lists NB-SALES-12 → SW-3F-01 (in Gi1/0/14, out Te1/1/1) → SW-CORE-01 → the edge firewall. 6. Back in the map, choose **Highlight VLAN** 30: only the devices carrying the sales VLAN stay bright. 7. Next week the notebook moves to another desk: after the next read it shows Gi1/0/22 , the tags change and **Port history** keeps both periods. **Worked example: a rack for the 3rd floor and traffic on an uplink** 1. In **Racks**, click **New rack**: name R-3F-01 , room IT room 3F , 42 units, place "Head office / 3rd floor". 2. Open the asset SW-3F-01 , Hardware tab, **Physical network**: choose rack R-3F-01 , unit 40. The switch gets Rack: R-3F-01 and Sala: IT room 3F . 3. In **Ports**, choose SW-3F-01 . The uplink Te1/1/1 shows ↓ 640 · ↑ 210 Mb/s, 64% of the link; click the rate to see the last 24 hours and find the 9:00 peak. 4. Point the floor's firewall to the collector on UDP 2055 to see who generates that traffic in the logical and service maps. ### Pitfalls and limits Nothing shows until a scan reads at least one device by SNMP ("No network device read by SNMP yet."). ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/H1pa76C-75zwjF7nSKo3t_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Traffic needs two SNMP reads to compute a rate; the first read only shows counters. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/Ia-4ZRlqHYd_MhtKKi2oO_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} A port with more than 8 MACs or with a neighbor is treated as an uplink and does not place devices. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/lWvgFLqnrJPYF1-AG8b9k_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} The last hop of the path can be a neighbor Hive does not read yet: add it to a scan with SNMP to go further. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/eJkBVJkcgvAvUlGFVjZKg_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} The tag names Porta and Sala are fixed, whatever the language of the console. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/m9_-UP4p9hHvrVOWQLovf_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} ### Layers: Network · Virtualization · Kubernetes On **Physical map** the **Network**, **Virtualization** and **Kubernetes** buttons add layers to the tree (your choice is remembered): switch → port → hypervisor host (ESXi, Hyper-V, Proxmox or Nutanix, by the host's inventory device) → its VMs → the Kubernetes nodes running on those VMs. Clicking a host opens the hypervisor view; clicking a node opens its cluster. A host, VM or node with no known switch port goes to the group **No known switch port**, never under an unrelated switch. The **Maps ›Virtualization** shortcut opens /network?layers=virt ; /network?layers=k8s opens the Kubernetes layer. ### Worked example: where the cluster nodes run 1. Open **Maps › Virtualization**: esx02 appears under SW-DC-01 · Te1/0/7 with its VMs. 2. Turn on **Kubernetes**: k8s-node-02 appears under the VM of the same name. 3. esx05 has no port read yet: it is in **No known switch port**; read SW-DC-02 by SNMP to place it. ### Related Discovery area ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/v5THvcvu9Nw89-29hSQaM_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} Service map ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/3bppWBKSB6xTLfQIW9S5g_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} Structure ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/_FxQ1ge3u2CJ55SUCvQ75_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} Step by step: create a collector ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/CWNhXvnDypk9uGFmaDdTz_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} ### IPAM, DNS and DHCP ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/C7MTSRKuLQTQIXprr33y0_image.png" size="67" isUploading="false" width="672" height="426" showCaption="false"} Screen: IPAM, DNS and DHCP **Maps › Physical map**, tab **IPAM**, shows your subnets and the use of each address. "In use" comes from what Hive already sees — the addresses of the assets, discovery scans of the last 30 days and active DHCP leases — and "reserved" from reservations made by hand (through the API) or imported from DHCP. DNS zones and DHCP scopes and leases are imported from files (BIND, Windows, ISC, Kea). IPAM only reads: it never creates or merges assets. ### What you can do here **Subnets**: add a subnet by hand with **Add subnet** or click **Find subnets** (discovery ranges, imported DHCP scopes and the /24 networks with at least 2 asset addresses). Each subnet shows a utilization bar, used, reserved and free addresses and when an address was last seen. Click the subnet to see the address grid (up to /22) and the table of addresses with MAC, name, asset and source. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/5I568GG259AXhO0qtwllM_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} **Conflicts**: the same IP seen with different MACs in the last 7 days (scans and DHCP), the same IP reserved more than once (by hand and on a DHCP server, or on two servers) and one MAC reserved on two addresses. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/6veRjcJTSb67BV_oBHVz4_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} **DNS**: import a zone and see **Stale: no live host** (an A record whose address was not seen in 7 days) and **Reverse does not match** (the PTR of the address points to another name). ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/3m7b9nvLT0QG8XhauVY0c_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} **DHCP**: import scopes and leases and see, for each lease, the asset that has its MAC. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/9ucK9SzGu7udpSc5DpZxj_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} ### Importing DNS and DHCP **BIND zone file**: paste or choose the zone file ( $ORIGIN , $TTL , relative names and multi-line SOA are understood). ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/T_B8VL34TUoqW8jWngC0G_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} **Windows DNS**: Get-DnsServerResourceRecord -ZoneName corp.local exported with HostName , RecordType , RecordData and TimeToLive columns ( Export-Csv ). ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/RXMe5HwHTflSbxbXf7Lah_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} **ISC**: dhcpd.leases (the last entry of each address wins) and, in the same paste, dhcpd.conf for the subnet … netmask … \{ range … } scopes. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/33RKDXHESRVkbMOOgAjnZ_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} | :inlineImage[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/m1EoRj5QclYupdMzaxgGX_image.png" alt caption size="10" width="5" height="5"} | **Kea**: the memfile lease CSV ( kea-leases4.csv ). | | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------- | | :inlineImage[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/Sgl5iLKtfGL_MQ5kJAFeW_image.png" alt caption size="10" width="5" height="5"} | **Windows DHCP**: Get-DhcpServerv4Scope \| Export-Csv for scopes and Get-DhcpServerv4Scope \| Get- | DhcpServerv4Lease | Export-Csv for leases; reservations ( ActiveReservation ) become reservations of that server. Open **Import a DNS zone** (in **DNS**) or **Import DHCP scopes and leases** (in **DHCP**), fill **Server** (and **Zone**, for DNS), choose the **Format**, choose the **File** or paste it in **Content**, and click **Import**. Importing again replaces the data of the same server (and zone, for DNS). **Worked example: find a free address and a duplicated reservation in the office** ### network 1. Open **Maps › Physical map**, tab **IPAM**, and click **Find subnets**: 10.50.0.0/24 appears with source **Asset addresses**. 2. Choose **DHCP**, open **Import DHCP scopes and leases**, fill **Server**dc01 , choose **Format Windows (CSV from PowerShell)**, choose leases.csv exported on the server in **File** and click **Import**. The toast says "Imported: 0 records, 0 scopes, 212 leases." 3\. Back in **Subnets**, 10.50.0.0/24 shows 83% with "201 used · 11 reserved · 42 free". Click it: the grid shows the free addresses in a light colour; hover 10.50.0.77 to confirm it is **Free**. 3. Open **Conflicts**: 10.50.0.40 is a **Duplicated reservation** (sources manual and dhcp\:dc01 ) — the printer was reserved by hand with another MAC. Remove the manual reservation through the API ( DELETE /api/v1/ipam/reservations/ ); the screen has no button for reservations. 4. In **DNS**, open **Import a DNS zone** and import **Zone**corp.local from **Server**dc01 (**FormatBIND zone file** or the Windows CSV). The finding gone.corp.local · 10.50.0.99 · Stale: no live host shows a record of a machine that left; delete it on the DNS server. ### Pitfalls and limits IPv4 only. Subnets from /16 to /32; the address grid is drawn up to /22. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/nOOzG3bPL0F3XdP7Zrrfu_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Adding, finding and removing subnets and importing DNS or DHCP need assets\:write ; reading needs assets\:read . Imported files above 20 MB are refused. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/ktLWFJAv0k22y6RQeCumB_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Reservations by hand are made only through the API ( POST /api/v1/ipam/reservations ); the screen shows them but has no button to create or remove them. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/NB7CptSrXT6b0mfbbO-Xk_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} A lease is linked to an asset only by MAC and only when exactly one asset has that MAC; a hostname or a DNS name never links (ARP and DNS are a last resort and ambiguous data does not merge assets). ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/5Pkvqi53TCnYbKhRytriM_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} "Stale" depends on what Hive sees: an address of a machine that no scan, agent or lease ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/7dVJlPVu6SNuXJfFbiiu4_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} reaches looks stale. The Infoblox (WAPI) connector and reading the Windows DNS/DHCP servers directly by the ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/x7wvwXjHD75jyMFEK7r6F_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} collector are not available yet: export the files and import them. Removing a subnet does not remove addresses, reservations or the DNS/DHCP data. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/XuHxI3nqeg3XycPUzJ56W_image.png" size="10" isUploading="false" width="5" height="4" showCaption="false"} ### Related Network and topology ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/mJXbGEl8b7n0ttq2kgu6c_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Map timeline and export ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/tKkdlPaLB2yFh70v6tcDb_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Discovery area ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/2AkfZFqNpZVuKYO3ozvAs_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} ### Firewalls, Wi-Fi and config backups ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/UJ9DVax_jMDpmzaQUe2i3_image.png" size="67" isUploading="false" width="672" height="423" darkWidth="672" darkHeight="423" showCaption="false"} Screen: Firewalls, Wi-Fi and config backups (1/2) ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/NpUnTBnk7HcJFb6me8lSd_image.png" size="67" isUploading="false" width="672" height="426" darkWidth="672" darkHeight="426" showCaption="false"} Screen: Firewalls, Wi-Fi and config backups (2/2) **Maps › Firewalls & Wi-Fi** reads FortiGate, Palo Alto, Cisco Meraki and Ubiquiti UniFi through their own APIs with a read-only account. Each firewall, access point and switch the API returns becomes a network device in the inventory (the same one the SNMP read and the physical map use), with its interfaces, firmware version, HA state, SSIDs, Wi-Fi clients and the switch port where each access point is plugged. **Maps › Config backups** keeps every version of the configuration of firewalls and switches, with secrets masked, shows the difference between two versions and raises an alert when the configuration changes outside a change window. Hive never restores a configuration: you download the version and apply it yourself. ### What you can do here Add a source with **Add source**: a FortiGate, a Palo Alto firewall, a Meraki organization or a UniFi controller. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/dd0Oovxf_-bpwddlo6SX1_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} See the devices with firmware, HA, switch port, Wi-Fi clients, open CVEs and the last backup; and the SSIDs with security, band, VLAN and clients. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/eSENsD8Y6Tl8HyQXcE1LK_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Read a source again with **Read now**, or remove it with **Remove**. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/1kZya_ZhgHDnDEKelfMFv_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Open a device in **Config backups**, compare a version with the previous one (**Side by side** or **Unified**) and **Download** it. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/NO9OJ2XsvnOSqNwPPbROt_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} Send a switch configuration with **Upload configuration**, and open a change window with **Open window** in **Change windows** so planned changes do not raise alerts. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/wEqqf5Nu9VZpMlQAK7UOH_image.png" size="10" isUploading="false" width="5" height="4" darkWidth="5" darkHeight="4" showCaption="false"} ### What is read from each vendor | **Vendor** | **What Hive reads** | **Configuration backup** | | ----------------- | ----------------------------------------------------------------------- | ---------------------------- | | FortiGate | system status, interfaces, HA mode and members | yes, by the REST API | | Palo Alto | system info, interfaces, HA state | yes, by the XML API (export) | | Cisco
Meraki | networks, devices, SSIDs, clients of the last hour, LLDP/CDP of the APs | no | | UniFi | devices (APs, switches, gateways), WLANs, Wi-Fi clients, AP uplink | no | The firmware becomes a software item of the device with its CPE (FortiOS and PAN-OS), so the vulnerability correlation finds the CVEs of that version like it does for any other software. ### Worked example: read a FortiGate and follow a change 1. On the FortiGate, create an administrator profile with read-only access and a REST API administrator hive-ro with it, limited to the Hive server address (Trusted Hosts). Copy the API key. 2. Open **Maps › Firewalls & Wi-Fi** and click **Add source** (needs agents\:admin ). 2. Fill **Name**FW-HQ , choose **Vendor** FortiGate, **Address**https\://10.20.0.1 , paste the key in **API key or password**, keep **Read every (minutes)** at 360 (from 15 to 10080) and keep **Back up the configuration (FortiGate and Palo Alto)** checked. Click **Add**. 3. Click **Read now**. The source turns **Read** and the device FW-HQ-01 appears with firmware 7.2.5 , HA a-p · primary · 2 members and the CVEs of FortiOS 7.2.5. 4. Open **Maps › Config backups**: FW-HQ-01 has 1 version. Somebody changes a firewall policy at night; on the next read a second version appears marked **Changed outside window**, and the alert "Network configuration changed outside a change window" opens. 5. Click FW-HQ-01 , then **Compare with previous** on the newest version: the changed policy lines show side by side, red on the left and green on the right. Passwords show as \ . 6. Before the next planned change, in the **Change windows** panel choose the **Device** (or **All devices**), fill **Starts**, **Ends** and **Note (change number)** and click **Open window**: changes inside it are saved without an alert. ### Worked example: back up a switch and place the APs 1. Read the switch SW-CORE-01 by SNMP in a discovery scan, so its ports are known. 2. Add the UniFi controller as a source (**Address**https\://unifi.lab:8443 , **Organization ID or site **default , the read-only user and password). 3. After **Read now**, AP-Lobby shows **Switch port**SW-CORE-01 · Gi1/0/13 and appears under that port on the physical map. 4. On the switch, copy the output of show running-config . In **Config backups**, open the switch and click **Upload configuration**, paste it and click **Save version**. The enable secret, SNMP communities and keys are masked before saving. ### Pitfalls and limits The account must be read-only: Hive only reads (GET, op and export calls). Restore is not done by Hive; **Download** gives the masked file, so secrets must be filled back by hand before applying it. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/dFOPTASXfYFkiDD5Kv40t_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} Adding a source, **Read now** and **Remove** need agents\:admin ; **Download**, **Upload configuration **and **Open window** need assets\:write . The **Address** must start with https\:// ; Meraki needs the organization ID and UniFi the user. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/4dL8qEn6XMAjRANzEZTVH_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} The certificate of the firewall or controller must be trusted by the Hive server (import the internal CA); self-signed certificates are refused. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/yDmK0T6r-ydMCLnxxyk4e_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Switch backup by SSH through the collector is not automatic yet: use **Upload configuration** (or the API POST /api/v1/network/devices//config-versions ) with the text read over SSH. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/CmZ8A3rjIRT_yUckDyV3x_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} A new version is saved only when the masked text changes, so a change only in a secret (a new password) is not seen. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/XH4UVotGx-talI6NHj5RV_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Meraki and UniFi firmware names do not map to a CPE: their CVEs are not correlated. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/NqkqT1ubW5WYJszYaS-Xb_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} UniFi OS consoles (UDM, Cloud Key Gen2) that answer only under /proxy/network are not read yet. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/AAbVug2B6v2KEwZCXfZxU_image.png" size="10" isUploading="false" width="5" height="4" darkWidth="5" darkHeight="4" showCaption="false"} Configurations above 5 MB are refused. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/nULSyLKuFMYQ9-a_zJVP-_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} ### Related Network and topology ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/wPnPqdEdCKrHwVd4cSLs9_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Vulnerabilities ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/HIJKunY9lRbmHqfi9X4cD_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} Alerts ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/66wPnpMZ7vRna3y58XDFm_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} Discovery area ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/f44w3pmS9ILVDoAs9HCl6_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} ### Map timeline and export to draw\.io and Visio ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/DFcd0FoxwrRZCgAHey3uc_image.png" size="67" isUploading="false" width="672" height="426" darkWidth="672" darkHeight="426" showCaption="false"} Screen: Map timeline and export to draw\.io and Visio Hive keeps the history of the maps: whenever the map changes, a snapshot is stored with only what changed (nodes and links added or removed). **Maps › Physical map**, tab **Timeline**, shows the map as it was at a date and time and what changed from then until now. Every map also has **draw\.io** and **Visio **buttons, next to **Image (PNG)** and **Image (SVG)**, that download an editable diagram. ### What you can do here Choose the **Map** (physical map or service map) and move the slider: **As of …** shows how many nodes and links the map had and lists, in green, what was added since then and, in red, what was removed. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/nEMBpeD9gRwNXH0hBNUoC_image.png" size="10" isUploading="false" width="5" height="4" showCaption="false"} **Record now** (shown only when the physical map is chosen) takes a snapshot of the physical map right away (Hive also takes one every hour, the first about 15 minutes after the core starts); if nothing changed, nothing is stored. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/E756z88zuhiPuXrdPx7wR_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} On any map, **draw\.io** downloads a .drawio file (open it in draw\.io or diagrams.net) and **Visio** a .vdx file (Visio XML drawing). ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/hBwJ2OENT6aX1L2oM8Rn1_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} **Worked example: what changed in the network since last Monday** 1. Open **Maps › Physical map**, tab **Timeline**, map **Physical map**. 2. Move the slider to the snapshot of Monday 08:00: "As of 10/19/2026 08:00" and "143 nodes and 151 links at that time". 3. Under **Changed from then until now**: + node NB-SALES-31 , − link SW-3F-01 — NB-SALES-12 and + link SW-3F-02 — NB-SALES-12 — the notebook moved to another switch. 4. Go to tab **Physical map** and click **draw\.io**: the file physical-map-20261022-1810.drawio opens in diagrams.net with the switches and machines as boxes connected by lines; move them and add notes for the change meeting. 5. Click **Visio** and open the .vdx in Visio; use **Save as**.vsdx to keep it in the current format. ### Pitfalls and limits History starts when the feature is installed: there is nothing before the first snapshot. Until then the tab shows **No snapshot yet**. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/tZwFN_-QQoE_zdJx563GW_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} The **draw\.io** and **Visio** buttons are hidden on narrow screens (phone); use a wider window or **Image (PNG)**. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/CuX9t7PlKqQlD3Kk0f_v1_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} The physical map is taken every hour, so a change that came and went within the hour may not appear. The service map has a timeline only when its nodes and links are sent through the API ( POST /api/v1/map-timeline/service/snapshot ); the console does not send it by itself yet. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/dYFS-LpR2qIpmsUkWQUj6_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Visio export is the XML drawing format ( .vdx ), not .vsdx : Visio 2013 and later open it and save it as .vsdx ; Visio for the web does not open .vdx . ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/bNcNFWpKL5muEh-Ekvnt4_image.png" size="10" isUploading="false" width="5" height="4" showCaption="false"} The export reads the drawn map: shapes become boxes or ellipses with their text, lines become connectors attached to the shapes where they start and end. Icons, colors and dashes are not kept; use SVG for a faithful picture. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/hm5ZGu0ztTxVbkDWo62Uw_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} ### Related Network and topology ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/V3mmeeY3N78wYbxonXbr4_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Service map ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/Ij-QhCZcz1ZOppzGDxa3X_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} Map builder ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/HyVfZswqTJ9MuhXcGDp-O_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} IPAM, DNS and DHCP ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/zXEj8RfJthU8JGIJcv69B_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} ### Virtualization ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/4IUhK6MPyF_zyjHWalvCA_image.png" size="67" isUploading="false" width="672" height="426" darkWidth="672" darkHeight="426" showCaption="false"} Screen: Virtualization Virtualization reads your hypervisors through a collector with a read-only account and shows the hosts, the VMs (and which inventory device each one is), the virtual switches, the datastores and the snapshots. It is in **Discovery › Virtualization**. Four kinds of connection exist: **vCenter / ESXi**, **Hyper-V**, **Proxmox VE** and **Nutanix (Prism Central)**. ### What you can do here Connect a hypervisor with **Connect hypervisor** and follow the read in the **Connections** tab. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/g4IltiWHF2sb8uxWGmkPN_image.png" size="10" isUploading="false" width="5" height="4" showCaption="false"} Read a connection again with **Read now**, or remove it with **Disconnect**. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/8T3rgkB4L7dMXcrWRCtXl_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} See the topology of one connection in the **Map** tab (**Physical** and **Logical** views). ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/6OW0BUtJsm0Pm7LQL6CDe_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} List the **Hosts** (hardware, cluster, VMs on and total) and the **VMs** (power state, system, network cards, inventory device). ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/fwDaEElNwWO4pluXOc8XL_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Find the VMs that are not in the inventory with **Only VMs out of the inventory**. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/tQ4c_kX_5ce1DqB-kQdvW_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Check the **Storage** tab (datastores and VM snapshots) and the **Virtual switches** tab (uplinks and port groups with their VLAN). ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/tPsbKB-BeMaM8ymJcTQrX_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} ### Step by step: connect a hypervisor 1. Open **Discovery › Virtualization** and click **Connect hypervisor** (needs the agents\:admin permission). 2. In **Hypervisor**, choose vCenter / ESXi, Hyper-V, Proxmox VE or Nutanix (Prism Central). The note below the field says which read-only account to use. 3. Fill **Name** (unique, up to 120 characters) and **Address** (name or IP of the server, optionally with the port). 4. Fill **User** and **Password**. For Proxmox the fields become **API token ID** ( user\@realm!token ) and **Token secret**. 5. For Hyper-V choose the **WinRM transport**: HTTPS (5986) or HTTP (5985). For the other kinds, a self-signed certificate is trusted by pasting its **Certificate fingerprint (SHA-256)** (64 hexadecimal digits) or the **CA (PEM)** that signed it; leave both blank to use the system CAs. 6. Choose the **Collector** that reaches the server and click **Connect**. 7. The message "Hypervisor connected: the first read started." appears and the row shows **Reading**. The list refreshes by itself every few seconds while a read runs; when it ends, the state is **Read** and **Contents** shows "hosts · VMs · in the inventory". The password or token goes to the vault and only goes to the collector at read time. Each connection is read again every hour. ### How a VM or host is recognized in the inventory Each VM and each host is matched with an inventory device, from the most to the least reliable evidence: **BIOS UUID** (also with the first three fields byte-swapped, as Windows shows some VMware UUIDs), **MAC**, **IP** and **name**. The **VMs** tab says how each one was matched ("matched by BIOS UUID", "matched by MAC"...). A MAC, IP or name repeated on more than one device only decides if exactly one of them has the agent; otherwise the item is not linked (an old ARP table or DNS record does not win). ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/7rZOF1CFQj_BwAQDU468F_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} A VM or host that matches no device **becomes an asset** with the hypervisor as its origin ("added to the inventory from the hypervisor"). This includes **powered-off VMs**: they enter the inventory too, so they show on the maps with the host → VM relation. When several VMs share the same BIOS UUID (copies restored from backup), the VMs that are on choose first. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/6b-W5GSwVE479vNY5ptAT_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} When an asset created by the hypervisor later meets the real record of the machine by UUID or MAC (agent installed, discovery, integration), both are merged by themselves: the real record stays and receives the tags, groups and history of the one created by the hypervisor. If they only match by IP or name, both stay and may show up as possible duplicates. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/2wwpueITsczEQeb2YLaDX_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} If the device already exists, the hypervisor only links it and fills what is empty: what the agent reports wins. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/lqPgziXC3y8qB7VT6TULg_image.png" size="10" isUploading="false" width="5" height="4" showCaption="false"} The device page shows where it runs (VM on which host and cluster) or, for a host, the VMs running on it. That is what links the Kubernetes node and the database server to the VM and the host on the maps. ### Worked example: vCenter with three hosts 1. Click **Connect hypervisor**, choose **vCenter / ESXi**. 2. **Name**vCenter SP , **Address**vcenter.corp.local , **User**hive-read\@vsphere.local (a vCenter account with the Read-only role as a global permission), **Password** the account password. 3. The vCenter uses a self-signed certificate, so paste its SHA-256 in **Certificate fingerprint (SHA-** **256)**. 4. **Collector**COL-SP01 , then **Connect**. 5. A few minutes later the row shows **Read** and "3 hosts · 48 VMs · 45 in the inventory". In **VMs**, tick **Only VMs out of the inventory**: the 3 VMs listed have no device linked (for example, two VMs with the same IP as other machines and no agent on any of them). 6. Open **Map** and pick vCenter SP : the **Physical** view shows cluster → host → VM; click a host to see its VMs and datastores. ### Worked example: Hyper-V host 1. On the host HV01 , add the account CORP\svc-hive-hv to the local **Hyper-V Administrators** group (only Get-VM, Get-VMNetworkAdapter and Get-VMSwitch are run). 2. **Connect hypervisor** › **Hyper-V**, **Name**HV01 , **Address**hv01.corp.local , **User**CORP\svc-hive-hv , **Password**, **WinRM transport** HTTPS (5986), **Collector**COL-SP01 , **Connect**. 3. After the read, **Hosts** shows HV01 with "12 VMs (9 on)" and **Virtual switches** lists the host's virtual switches. ### Worked example: Proxmox VE cluster 1. In Proxmox, Datacenter → Permissions → API Tokens, create the token reader for the user hive\@pve with the **PVEAuditor** role, without privilege separation. 2. **Connect hypervisor** › **Proxmox VE**, **Name**PVE Lab , **Address**pve1.corp.local (any cluster node, port 8006), **API token ID**hive\@pve!reader , **Token secret** the secret shown once by Proxmox, **Collector**, **Connect**. 3. After the read, LXC containers show in **VMs** marked "(container)". **Storage** lists the storages of each node with capacity, free and % used, and the snapshots of the VMs with their age. ### Worked example: Nutanix Prism Central 1. In Prism Central, create the local user hive-read with the **Viewer** role. 2. **Connect hypervisor** › **Nutanix (Prism Central)**, **Name**Nutanix DC2 , **Address **pc.corp.local:9440 , **User**hive-read , **Password**, **Collector**, **Connect**. 3. The collector lists clusters, hosts, VMs and subnets through the v3 API; the row shows the counts when the read ends. ### Worked example: two connections to the same hypervisor The team connects vCenter SP and also, for a test, the ESXi host esx03.corp.local directly as ESX03 direct . 1. The VM app-erp-01 runs on esx03 and has no agent. The first read ( vCenter SP ) creates its asset. 2. The read of ESX03 direct sees the same VM with the same BIOS UUID and MAC: it links to the asset already created instead of creating a second one. Hosts work the same way. 2. In **VMs**, app-erp-01 appears once per connection, both pointing to the same inventory device. Only UUID or MAC join items seen by two connections; an IP or a name alone never does. ### Worked example: disconnect a connection 1. In **Connections**, click **Disconnect** on ESX03 direct and confirm "Disconnect ESX03 direct?". 2. The hosts, VMs, switches and datastores read by that connection and its secret in the vault are removed. Nothing changes on the hypervisor. 3. Assets that **only this connection created** and that nobody else claimed (no agent, not seen by another connection) leave the active inventory (they are retired, not deleted). app-erp-01 stays active because vCenter SP still sees it. ### Worked example: a powered-off VM and an old snapshot 1. The VM old-intranet is powered off on vCenter SP . After the read it is in **VMs** with the state **off **and it is an inventory device ("added to the inventory from the hypervisor"), so it shows on the maps and in reports. 2. In **Storage**, the snapshot before-upgrade of old-intranet shows "212 days" highlighted (older than 7 days), and the datastore DS-SAS-01 shows 93% used in red (90% or more). 3. Remove the snapshot in vCenter; on the next read (or with **Read now**) it leaves the list. ### Pitfalls and limits Connecting, reading now and disconnecting need agents\:admin ; viewing needs assets\:read . ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/yoXi2ExAr8Qk5PRpg-TT__image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} A new read cannot start while one is running ("The hypervisor is being read now."). ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/NTHYkoY1k46T9AJg9RLfW_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} If the collector does not finish within an hour, the connection goes to **Error** with "The collector did not finish the read." and the fix "Check that the collector is online and reaches the hypervisor." ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/CyntWRZRF7SXlg9jIUJk8_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Datastores and snapshots come from vCenter and Proxmox. Hyper-V and Nutanix show hosts, VMs and networks. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/GV0HZwbz7SMdIlT0r4D9j_image.png" size="10" isUploading="false" width="5" height="4" showCaption="false"} For Proxmox, **API token ID** must be user\@realm!token . ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/DZ8GWNEvXYiIx0UFR45wu_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} The fingerprint must be the SHA-256 of the certificate (64 hexadecimal digits, with or without ":"). ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/OPwGYOvEkvvbO3NgjRbwx_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} The screen has no edit form: to change the address, the account or the read interval (15 to 1440 minutes, default 60) use the API ( PUT /api/v1/virtualization/connections/ ); a new password or token replaces the one in the vault. Disconnecting and connecting again would retire the assets the connection created. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/pWB3ZwNapYjIqqpUFC-LJ_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} ### Related Discovery ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/1zpxG9Q2IlyTW1x8nOEmH_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Network map ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/XufVOWEio_QqSptKCb_-Z_image.png" size="10" isUploading="false" width="5" height="4" showCaption="false"} Kubernetes ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/xgh_st11JGM96xfJ0Ds0m_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} Service path and logical map ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/Nh_efjeT3Wk1sUSU8nh75_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} Inventory ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/GBnhZ63mxSlPI2iWLXY0a_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} ### Kubernetes ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/8ZUsNLTWUsw0srX3580iF_image.png" size="67" isUploading="false" width="672" height="426" darkWidth="672" darkHeight="426" showCaption="false"} Screen: Kubernetes Kubernetes reads your clusters through a collector with a read-only account: what runs, the images and their CVEs, the dependencies and the map from the published service down to the database. It is in **Discovery › Kubernetes**. The list shows each cluster with its state, contents ("nodes · workloads ·pods"), images with CVEs and the last read; click a cluster to open its detail. ### What you can do here Connect a cluster with **Connect cluster** (a 3-step wizard). ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/RvaEpgtx3MIcNseydzQTj_image.png" size="10" isUploading="false" width="5" height="4" showCaption="false"} Open a cluster and use its tabs: **Logical map**, **Service paths**, **Workloads**, **Images**, **Nodes** and **Namespaces**. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/965BBX4lW0bO-plwoHSa2_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Read the cluster again with **Read now**, change how Hive authenticates with **Access**, or remove it with **Disconnect**. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/6j0vfkStPdG_E1mucA4lA_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Click an object on the map to see what it depends on, who uses it and what stops if it goes down. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/2hHBYuKWOuGVXNy-QS_-a_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} ### Step by step: connect a cluster 1. Open **Discovery › Kubernetes** and click **Connect cluster** (needs agents\:admin ). 2. **Step 1 of 3**: fill **Cluster name**, choose the **Distribution** (k3s, Amazon EKS, Azure AKS, Google GKE, OpenShift, Rancher (RKE2) or Other Kubernetes) and the **Collector** that reaches the API server (private clusters stay private). Click **Next**. 3. **Step 2 of 3**: run the commands shown, with an administrator account of the cluster. They create the service account hive-reader in kube-system , a cluster role that only has get, list and watch (no Secrets), the binding, a token valid for one year, and print the API address and the cluster CA. Each line has **Copy**. Under **Optional: Gateway API, Istio or OpenShift routes** there are two more commands to read those objects. Click **Next**. 4. **Step 3 of 3**: paste the **API address** (like https\://api.cluster:6443 ). Under **Trust in the API server** choose **Cluster CA** (paste the PEM), **Server certificate fingerprint** (SHA-256) or **Public certificate** (managed APIs signed by a public authority). Under **Access** choose **User and token **(paste the token) or **Client certificate** (certificate followed by its key). 5. Click **Connect**. "Cluster connected: the first read started." appears; the cluster is read again every hour, or with **Read now**. The token or the certificate stays in the vault and only goes to the collector at read time. ### What is read Nodes, namespaces, workloads (Deployment, StatefulSet, DaemonSet), pods and containers (image and ports), Services, Endpoints, Ingress, network policies, volumes and, only when turned on, ConfigMaps; with the optional commands, Gateway API, Istio virtual services or OpenShift routes. **Secrets are never read.** From environment variables (and ConfigMaps, when read) only the addresses (host\:port, URLs without password) leave the cluster, to draw the dependencies. Nodes are linked to inventory devices by name or IP. If the account cannot list some kinds, the cluster shows "Partial read" with the kinds missing; fill **User (service account)** under **Access** to see the exact commands that grant the rest. ### The cluster tabs **Logical map**: from left to right, what is published (Ingress, routes), Services, workloads, data and destinations outside the cluster, and the nodes (**Show nodes**). Each link says where it came from (Ingress rule, label selector, Endpoints, environment variable, ConfigMap, network policy, service mesh or connection seen by the agent) and its confidence: solid line high, dashed medium, dotted low. A destination that is an inventory device shows its name; a managed cloud database shows as **Cloud service**. When the node's agent sees the connection, the dependency is "confirmed by the agent". ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/0LlxzFtBJAsfHmIJLBRfu_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} **Service paths**: one line per published address, from the entry to the end of the chain, with the data in bold. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/d9Tn9JPvo-wC_NYYydIWh_image.png" size="10" isUploading="false" width="5" height="4" showCaption="false"} **Workloads** and **Nodes**: what runs, how many replicas are ready and the inventory device of each node. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/_f_6WfKoUh4J6DD6B-RQT_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} **Images**: product and version come from the image name and tag (postgres:16.2 → PostgreSQL 16.2) and the CVEs are those of that version in the NVD, with the exploited ones (KEV) highlighted. Images without a fixed version show "no fixed version (latest or digest)". Packages inside the image are not read. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/tDB_rsxvntm6IchEcHp8X_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} **Namespaces**: one card per namespace with what runs in it; click to open its map. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/zhe80tPIZfG8e2mbl9aZJ_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} Click any object on the map to see **Goes to**, **Used by** and **If it goes down**: what stops and what only loses capacity (a workload with replicas on other nodes). ### Worked example: connect an EKS cluster 1. **Connect cluster**, **Cluster name**eks-prod , **Distribution** Amazon EKS, **Collector**COL-AWS01 , **Next**. 2. Copy the six commands and run them with kubectl against eks-prod . Command 4 prints the token; commands 5 and 6 print the API address and the CA. **Next**. 3. **API address**https\://ABC123.gr7.us-east-1.eks.amazonaws.com , **Trust in the API server** › **Public certificate**, **Access** › **User and token**, paste the token, **Connect**. 4. A minute later the list shows eks-prod**Read** with "6 nodes · 41 workloads · 97 pods" and "58 images · 12 with CVEs", and the red pill "2 exploited (KEV)". 5. Open eks-prod › **Images**: nginx:1.21.6 shows 9 CVEs. Open **Service paths**: shop.example.com →Service web → Deployment web → Service api → Deployment api → the RDS database prod-orders (cloud service). ### Worked example: impact of a node 1. In eks-prod › **Logical map**, tick **Show nodes** and click the node ip-10-0-3-21 . 2. **If it goes down** shows "Stops: redis-cart." (one replica only, on this node) and "Loses capacity (replicas elsewhere): api, web." 3\. Scale redis-cart to 2 replicas on other nodes; after the next read the node no longer stops anything. ### Worked example: self-signed API on k3s 1. Connect k3s-lab without knowing its certificate: **Trust in the API server** › **Public certificate**. 2. The first read fails (state **Error**) and the cluster page shows "The API server showed this certificate (SHA-256), which no known CA signs:" with the fingerprint. 3. Check it with whoever runs the cluster ( openssl s\_client -connect host:6443 | openssl x509 -noout -fingerprint -sha256 ) and click **Trust this certificate**: "Certificate pinned; reading the cluster again." ### Pitfalls and limits Connecting, reading now, changing access and disconnecting need agents\:admin ; viewing needs assets\:read . ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/ySgbjLFobT8JTN_aL7Feg_image.png" size="10" isUploading="false" width="5" height="4" showCaption="false"} The API address must start with https\:// . The CA must be the decoded PEM (BEGIN CERTIFICATE). ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/OnTw6doFogMzT0RNjWT8W_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} A client certificate pasted in the token field is refused with "This is a client certificate: choose that option." ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/bYBP22EKvl9lhTB9ZEqLN_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} **Disconnect** removes what was read and the token in the vault; the cluster itself is not touched. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/5dzcdyxVZcTJ2XbWp2OOO_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} The read interval (15 to 1440 minutes, default 60) is changed only through the API. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/-x9lqJjS_2ZvXrvKZgAEU_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} ### Dependencies and logical map The **logical map** goes from left to right (or top to bottom: **Horizontal**, **Vertical** or **Automatic**, remembered per person): what is published (Ingress, routes), Services, workloads, data and destinations outside the cluster, and the nodes. Each link says where it came from — Ingress rule, label selector, Endpoints, environment variable, ConfigMap, network policy, service mesh or a connection seen by the agent — and the confidence (high, medium, low). A destination that is an inventory device (a database server) shows its name; a managed cloud database (RDS, Azure SQL, Cloud SQL) shows as a cloud service. When the node's agent sees the connection to the destination, the dependency is confirmed. Use **Levels** to show from the entries down to the level you choose (1 = only what is published; the last one = everything down to the nodes); it starts at a readable level. With more than one namespace, each namespace is a box; on **Map of the whole cluster** click the name to collapse or expand it. A big layer splits into more columns, the order crosses as few lines as possible and **Fit** makes it fit the screen. Clicking an object opens the panel beside the map: what it **depends on**, what it **affects** and what stops if it goes down. ### Service path and impact **Service paths** shows, for each published address, the hops down to the database, grouped by namespace (search by name or host, filter by namespace and host). Each hop is a chip with its kind, name and a short state: host\:port and TLS on the entry, type and ports on the Service, ready/desired replicas on the workload and the address of the data at the end. Click a path for the mini-map and the panel with the public host, the pods and the nodes they run on, the images with CVEs/KEV and what stops if the end of the chain goes down; **Open in the logical map** shows the whole map with that chain highlighted (or only it). Click an object on the map to see **what stops if it goes down**: whoever depends on it stops; a workload with replicas on other nodes loses capacity when a node goes down. ### Managed clusters from the cloud (EKS, AKS, GKE) A cluster discovered by a cloud account (**Cloud → Resources**, kind Kubernetes) is read with the **identity of the cloud account**, without a service account token: **Read this cluster** takes the API address and the CA from the provider, and at each read the core generates a short-lived token that goes to the collector with the task (it is never stored). In the account, **Kubernetes** turns on reading every managed cluster automatically, with the collector that reaches them. The Kubernetes list shows the provider and the account; the cluster page links back to the cloud resource. Token or client certificate under **Access** still work for any cluster. **Example — EKS.** Account "AWS prod" (access key of the IAM user hive-reader) finds aurora-eks in us-east-1. **Read this cluster** calls DescribeCluster (address and CA) and each read uses the same token as aws eks get-token . If the cluster answers 401 or 403, the page shows the commands with the ARN of the key: aws eks create-access-entry --cluster-name aurora-eks --region us-east-1 --principal-arn arn\:aws\:iam\::123456789012\:user/hive-reader and aws eks associate-access-policy ... --policy-arn arn\:aws\:eks\::aws\:cluster-access-policy/AmazonEKSViewPolicy --access-scope type=cluster . If nodes or volumes stay missing, bind hive-read to a group and put the group on the access entry ( --kubernetes-groups hive-readers ). Only clusters in CONFIG\_MAP mode (aws-auth) use eksctl create | iamidentitymapping . | | -------------------- | **Example — AKS.** Account "Azure prod" (app registration with Reader) finds aurora-aks. The core takes the address and the CA from listClusterUserCredential and signs in with a Microsoft Entra token for the AKS server application. Give the service principal "Azure Kubernetes Service RBAC Reader" and "Azure Kubernetes Service Cluster User Role" on the cluster ( az role assignment create --assignee \ --role ... --scope \ ), or, with Kubernetes RBAC, bind hive-read to its object id ( --user= \ ). A cluster with local accounts only does not accept the Entra token: connect it with a token. **Example — GKE.** Account "GCP lab" (service account key) finds aurora-gke. The core takes the endpoint and the CA from clusters.get and signs in with the OAuth token of the service account. Give it roles/container.viewer ( gcloud projects add-iam-policy-binding \ --member=serviceAccount:\--role=roles/container.viewer ) or bind hive-read to the e-mail of the service account. ### ConfigMaps: optional and off by default ConfigMaps often hold passwords, tokens and keys, so the main hive-read role no longer includes them. In the wizard, **Optional: read ConfigMaps (off by default)** shows a warning and two separate commands ( hive-read-configmaps ); turn on **Read ConfigMaps (endpoints only)** under **Access** to use them. Even then the collector keeps only what looks like an address and drops everything else before sending: Kept: host and port of URLs ( postgres\://app\:secret\@pg.data:5432/orders → pg.data:5432 ), of JDBC ( jdbc\:sqlserver://mssql.corp:1433;… , Oracle @//ora.corp:1521/ORCL ), of DSN strings ( Server=sql01,1433;… , host=pg port=5433 … , user\:pw\@tcp(mysql:3306)/db ) and of host\:port lists (Kafka bootstrap). ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/bdYGhPljDUyQ1ACfknygb_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Dropped: users, passwords, tokens, keys, certificates, paths, query parameters and any value that is not an address; only the names of the keys that held an address are kept. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/gcHr9ByDPaTKzQBXECh_s_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} With reading off the cluster shows the note "ConfigMap not read (optional; may contain secrets)" — it is never listed as missing in a partial read. ### Chains that stop at the Service A Service reaches its workload by, in this order: the pods listed in its **EndpointSlices** (discovery.k8s.io) or **Endpoints**; the label selector on the pods; the selector on the workload's pod template (a workload scaled to 0). A pod whose ReplicaSet was not read still reaches its Deployment by the pod-template-hash . When nothing is found the chain ends with an explicit marker instead of stopping silently: **Service without endpoints** (no pod matches the selector, no pod ready, or no selector) or the workload with **0 replicas**. ### Dependencies across namespaces Cluster DNS names point to the real Service, in any namespace, instead of a node "outside the cluster": svc , svc.ns , svc.ns.svc , svc.ns.svc.cluster.local and the pod name of a headless Service ( kafka-0.kafka-headless.hml-tools.svc.cluster.local ), found in environment variables, arguments, ConfigMap addresses, ExternalName, Gateway and Istio routes. Two more sources add links: traffic seen (NetFlow/IPFIX and the agents' flows from a pod IP to a ClusterIP or pod IP, origin **seen in traffic**, high confidence; it also confirms a link the configuration already declared) and a **NetworkPolicy** with namespaceSelector (declared, medium confidence). ### Namespace map and impact on the map Opening a namespace shows one consolidated map with all its paths: entries on the left, objects used by several paths marked **shared by N**, the **common end** marked, and every namespace it depends on as a block ("hml-tools · 3 here depend on it", with what is used there). Click a block to open it in place (recursively, following **Levels**) or ↗ to open its own map in a new tab. Selecting an object draws its impact on the map, even outside **Only this path** or the levels shown: red stops, orange loses capacity, gray uses it, blue is what it depends on; items outside the original view are dashed. **Show impact** / **Back to the path** switches it. Clicking an item in the side panel shows it on the map (and the first click on an affected node highlights it in the panel). **Published services that stop **lists each entry (host, kind, namespace and the business service, when there is one) with a link to its path in **Service paths**. ### Worked example: Kafka in another namespace 1. Open the namespace hml-app . The two Ingresses api and front converge on the Deployment api , marked **shared by 2**. 2. The block hml-tools · 1 here depend on it lists kafka-headless, redis-master : api uses KAFKA=kafka- | 0.kafka-headless.hml-tools.svc.cluster.local:9092 . | | --------------------------------------------------- | 3. Click the block: the StatefulSet kafka and the Deployment redis open in place; the Ingress batch ends in **Service without endpoints: no pod matches the selector**. 4. Click kafka : the Ingresses api.hml.corp and app.hml.corp turn red and appear under **Published services that stop**, the first with "business service: Orders"; click it to open its path. ### Related Cloud ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/6tNozH6nVWjvN53JdutwC_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Virtualization ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/_DfgOZlTUMq82-R-VeZrh_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} Service path and logical map ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/tFvcXA9grXM6H0qg_Immi_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} Vulnerabilities ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/F29HbLol4ixeu08ertYlo_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} ### API inventory ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/N67HonFx9F7IwBcgmbJeY_image.png" size="67" isUploading="false" width="672" height="426" darkWidth="672" darkHeight="426" showCaption="false"} Screen: API inventory The API inventory lists the APIs of the company with their operations (method, path, authentication and tags) and shows the shadow APIs: routes that the applications answer or that the Ingress publishes without any documentation. It is in **Discovery › APIs**. ### What you can do here Import an OpenAPI 3 or Swagger 2 document (JSON or YAML), pasted or fetched from an https address. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/vPWcfcUeCRiaOTn0Ujhto_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Read the APIs of a gateway: Kong Admin API, Azure API Management or Apigee. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/7QkHf4mlblvXoTEmvsUeb_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Open an API to see each operation and which ones declare no authentication. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/uPh8cHFH_s0UAfXdh86rs_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} See the Kubernetes Service that publishes the API (found through the Ingress path) and the business service. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/cwmo44gImWiDP0LgEPrHk_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} Compare what is documented with what is seen: undocumented routes and documented operations never called. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/G86AwomUCFBpgkjdg2Wg2_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} ### Where the data comes from | **Source** | **What is read** | | -------------------- | --------------------------------------------------------------------- | | OpenAPI / Swagger | title, version, servers, each path and method, security and tags | | Kong | services, routes (paths and methods) and the authentication plugins | | Azure API Management | APIs (path, subscription) and their operations (method, URL template) | | Apigee | proxies, the last revision, the base path and the conditional flows | | OpenTelemetry | server spans with http.route (calls in the last 7 days) | | Kubernetes | Ingress paths already read from the clusters | ### Worked example: find a shadow API 1. Open **Discovery › APIs** and click **Import OpenAPI**. 2. Paste the openapi.yaml of the Orders service in **Document (JSON or YAML)** (or fill **Or the document URL (https)**) and click **Import OpenAPI**; the toast says how many operations were imported. 3. In the **Inventory** tab, the **Service** column of the new API shows shop/orders : the Ingress publishes /orders to that Service. 4. Open the API: the operations appear with method, path and authentication; GET /health shows "none declared". 5. Open the **Shadow APIs** tab. Under **Undocumented**, GET /orders/internal/dump appears, seen by OpenTelemetry with 2 calls: a route answered in production that nobody documented. 6. Under **Documented but never seen**, DELETE /orders/ appears: no call in 7 days. Confirm with the team whether it can be retired. ### Worked example: read Kong 1. Click **Read gateway** and choose **Kong** in **Gateway**. 2. Fill **Management API address** with the Admin API address, like https\://kong-admin.example:8444 , and **Credential** with the admin token when RBAC is on. 3. Click **Read gateway**: each Kong service becomes an API and each route an operation; routes of services with key-auth , jwt or oauth2 show that authentication. ### Pitfalls and limits Viewing needs assets\:read ; **Import OpenAPI**, **Read gateway** and **Remove** need assets\:write . ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/oUPGckndBMkfqCgxSSgfx_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} The gateway credential is used only for that read and is not stored; read again to update. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/H45pDJy40v_HmHA5vIEgK_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} The document address goes through the protected outbound check: https only, no internal addresses unless the installation allows them, no redirects, up to 10 MB. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/yODx3Q0fFJNDb8p-R10r7_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Shadow APIs need OpenTelemetry server spans with http.route ; spans without a route (only the span name) are not compared. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/UaPjlWZo7V-scUz9sWLHy_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Ingress paths are prefixes: a path is documented when some operation is under it. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/h9WFO0TSAxzFzuQ4jtN7Z_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} Apigee flows are read from the condition text ( proxy.pathsuffix and request.verb ); flows with other conditions become ANY . ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/WWTsm3u-Ayxg3PrCpN7WR_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} ### Related Kubernetes ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/aKfHkKfTbCzaWBa31SbhJ_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} Applications ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/JRDafDCce4Y4JvcGB_qCq_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} Business services ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/-ziJmkHp-R1o_JbG-FiFa_image.png" size="10" isUploading="false" width="5" height="4" showCaption="false"} Container SBOM ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/ibmKhbIBVa-XYykVvwKUQ_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} ### Code and CI/CD ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/vomQlKJTLqNj85YwlW0hH_image.png" size="67" isUploading="false" width="672" height="423" showCaption="false"} Screen: Code and CI/CD Code and CI/CD reads your code platforms with a read-only token: the repositories and their posture, the pipelines with their last runs, the published packages and container images, and the open-source dependencies with their known vulnerabilities. It is in **Security › Code and CI/CD**. Hive never writes to the platform: no commits, no settings, no webhooks. ### What you can do here Connect GitHub, GitLab, Bitbucket or Azure DevOps with a read-only token (the token goes to the vault). ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/2r8DldrLSgHFZQF8ViGPL_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} See each repository with its visibility, default branch, protection, secret scanning and last push, and the posture checks that failed. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/i0OZZTajmCiXdb87aEBQB_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} See pipelines and workflows with the last status, the number of runs and how many failed. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/A1NFmll41ZyVt_SN0j2jU_image.png" size="10" isUploading="false" width="5" height="4" darkWidth="5" darkHeight="4" showCaption="false"} See packages and registry images, and which Kubernetes images come from each repository. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/1nZsfx3wpAfscaXPA4jBE_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} See the open-source dependencies and the ones with known vulnerabilities. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/els7qObVidfbzzQ5sQznO_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} ### What is read | **Platform** | **Repositories** | **Pipelines** | **Packages** | **Dependencies** | | ----------------- | ------------------------------------------------------------- | ------------- | ------------------- | --------------------------------------- | | GitHub | organization repositories, branch protection, secret scanning | Actions runs | container packages | dependency graph (SBOM), else manifests | | GitLab | group projects (with subgroups), protected branches | pipelines | group
packages | manifests | | Bitbucket | workspace repositories | Pipelines | — | — | | Azure
DevOps | Git repositories of the organization/project | builds | — | — | Manifests are read from the default branch: package.json , pom.xml , go.mod and requirements.txt . Only pinned versions count ( 4.17.20 , ^4.17.20 , ==3.2.0 ); open ranges ( >=2 , \* ) are skipped because there is no single version to check. ### Posture checks **Public**: the repository is visible to anyone. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/5v4FMHJVxE9qQQco7-imu_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} **Branch unprotected**: anyone with write access can push to the default branch without review. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/kSzYuKvCKVZjKI_7X7HJ6_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} **Secret scanning off**: the platform reports that secret scanning is disabled (only when the platform tells; unknown is not a finding). ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/_adtwmIV22lKZw1Tol56D_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} **Stale**: not archived and no push for more than 180 days. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/gzYc4gdPxaDdVLdzy6YLZ_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} ### Dependencies and vulnerabilities Each dependency (ecosystem npm, Maven, Go or PyPI, name and version) goes into the daily OSV query of the vulnerability feed, the same one used for Linux packages. Until the next query a dependency shows as **Not checked yet**. The OSV advisories already carry the CVE aliases; see Vulnerabilities. ### Repositories and Kubernetes images A repository is linked to a Kubernetes image when the image name (without registry and tag) equals the repository name, or the name of a container package of that repository: acme/api → ghcr.io/acme/api:1.4.2 . **Worked example: connect GitHub and find a vulnerable dependency** 1. On GitHub, create a fine-grained token for the organization acme with read-only access to metadata, contents, actions, administration (branch protection), dependency graph and packages. 2. Open **Security › Code and CI/CD**, click **Connect platform**, choose **GitHub** in **Platform**, type GitHub acme in **Name** and acme in **Organization, group or workspace**, paste the token in **Read-** **only token** and click **Connect** (needs integrations\:admin ). 2. In the **Connections** tab, click **Read now** on GitHub acme . The **State** turns **Read** and the **Repositories** tab lists acme/api with the **Posture** checks **Public** and **Branch unprotected**. 4. Open the **Dependencies** tab and tick **Vulnerable only**: after the daily OSV query, lodash 4.17.20 in acme/api shows GHSA-35jh-r3h4-6jhm . 5. In **Repositories**, the **Kubernetes images** column of acme/api shows the image ghcr.io/acme/api:1.4.2 running in the cluster eks-prod ; open Kubernetes to see what depends on it. ### Pitfalls and limits Connecting, reading and removing need integrations\:admin (without it, **Connect platform**, **Read now** and **Remove** are hidden); viewing needs vulnerabilities\:read . ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/ABkt_rLQ69fPJrkBZXN6L_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} There is no scheduled read of the platform: the data changes only when someone clicks **Read now**. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/E1aTXmJfcabiyyR7B0Hg0_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} A token refused by the platform (HTTP 401/403) leaves the connection in **Error** with "The platform refused the token (HTTP 401). Check its read scopes."; check the token scopes. The token is never shown again. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/8TpEnurE0KjA8o7ZNuR1g_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Only the first page of each list is read (up to 100 repositories and the last 30 runs per repository). ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/htRcG_VGMZd4kegH5jzCd_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Bitbucket and Azure DevOps: protection, secret scanning, packages and dependencies are not read in this version. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/M9n_cnMdHbpgFwgdaAwCw_image.png" size="10" isUploading="false" width="5" height="4" showCaption="false"} Transitive dependencies only come from the GitHub SBOM; manifests give the direct ones. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/LPDh2CfAwyQTWGtKw4_jO_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Removing the connection deletes what was read and the token in the vault. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/TRhxNw21Z8HTvuBf_-WI7_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} ### Related Vulnerabilities ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/ANmrn79ImlyzlzinZBOxo_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} Kubernetes ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/Mx4UUULClV7oqkpTsyBSa_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} External surface ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/Kiv-pVT8XRfyllCKMDSXc_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} ### Container SBOM ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/8ZUsNLTWUsw0srX3580iF_image.png" size="67" isUploading="false" width="672" height="426" darkWidth="672" darkHeight="426" showCaption="false"} Screen: Container SBOM The container SBOM brings the packages inside each image (the software bill of materials) and correlates them with CVEs, so an image gets findings even when it is tagged latest . It is in **Discovery ›Kubernetes**, in the **Images** tab of a cluster, under "Images by workload (SBOM)". ### What you can do here Send a CycloneDX or SPDX JSON SBOM for an image digest, from the pipeline through the API or from the screen: on a line that shows "no SBOM", click **Send SBOM** and fill **SBOM file (CycloneDX or SPDX JSON)**, **Image reference (registry/repo\:tag)** and, when the SBOM does not carry it, **Image digest (sha256:…), when the SBOM does not carry it**. The packages are correlated with CVEs right away. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/yJuKJGqO3itXGV6QTj5gX_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} See, per workload, the images it runs and how many package CVEs apply. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/QkxRBN4gZ4t-KtRevYVFr_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Open an image to see each package with its CVEs, severity and KEV. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/_2uJK0TyKzwdbDumdwH45_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} Ask a configured scanner (Trivy or Grype behind an adapter) for the SBOM of an image, through the API ( POST /api/v1/k8s/sbom/scan ); there is no button for it on the screen. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/m2oJBvjBwVX6rVW8QwQtY_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} ### How the CVEs are found | **Package** | **Base used** | | ------------------------------------------- | ------------------------------------------------------------------------- | | deb, rpm (Debian, Ubuntu, AlmaLinux, Rocky) | OSV for that version in the image distribution, which considers backports | | npm, PyPI, Maven, Go, NuGet… | OSV for the language ecosystem, when that version was already queried | | any package with a CPE | NVD version ranges, like the inventory programs | ### Worked example: CVEs for an image tagged latest 1. In the pipeline, generate the SBOM: trivy image --format cyclonedx -o sbom.json | registry.example/shop/orders\:latest . | | -------------------------------------- | 2. Send it: POST /api/v1/k8s/sbom?image=registry.example/shop/orders\:latest with the file as the body (an API account with assets write permission). 3. Open **Discovery › Kubernetes**, the cluster, and the **Images** tab. 4. Under "Images by workload (SBOM)", the shop/Deployment/orders line shows, in the **Package CVEs** column, the number of package CVEs and the highest CVSS. 5. Click **Packages**: the CVEs come first (KEV on top), then every package with its version. 6. After the next vulnerability base load, packages queried for the first time also get their CVEs; use POST /api/v1/k8s/sbom/correlate to correlate again right away. ### Pitfalls and limits The SBOM is stored by digest; when the document does not carry it (some SPDX exports), inform the digest when sending. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/b75IOnN4RyDegrA3Xf-pq_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} The workload matches the SBOM by the digest in the image reference or by the same reference (repo\:tag); a tag moved to another build keeps the old SBOM until a new one is sent. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/Zk4XuYxL_4AxWWHK-RVId_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} OSV is used for Debian, Ubuntu, AlmaLinux and Rocky packages, which enter the OSV load automatically; Alpine packages get CVEs only through a CPE, and language packages get OSV CVEs only when that version was already queried. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/g0n8iQZHvkgfi52HMQ_Fz_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} The scanner is optional ( hive.sbom.scanner-url ); without it, a scan request fails with "No image scanner is configured." and the SBOMs come from the pipeline or the screen. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/zlar2Bh6wyAZkM9F1z9Ia_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Sending an SBOM, scanning and correlating need the assets write permission; reading needs assets read. A file that is not CycloneDX or SPDX JSON is refused with "This is not a CycloneDX or SPDX JSON document." ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/TZuO5Uoxf-3ck0ln6_TL5_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Image findings are separate from the asset findings: they do not count in the asset risk score. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/T82ZI4ZVIGwEPi7m_snfE_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} ### Related Kubernetes ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/-u8ADA0o5-VRCJlOP7jui_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} Vulnerabilities ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/oGEjUTJ9rOmquVNXh5aOV_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} API inventory ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/0Dq9nWc8BSiCwVYpUlwpz_image.png" size="10" isUploading="false" width="5" height="4" darkWidth="5" darkHeight="4" showCaption="false"} ### External surface ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/ppIN_TO_EgjNwj7-iIHcl_image.png" size="67" isUploading="false" width="672" height="426" darkWidth="672" darkHeight="426" showCaption="false"} Screen: External surface External surface shows what the company exposes on the internet, looking only at what belongs to it: the domains and address ranges that the customer confirmed. Collection is passive only: public certificates (certificate transparency), DNS resolution and imported exposure data (Shodan, Censys). **Hive does not scan, probe or connect to the discovered addresses.** It is in **Security › External surface**. The page has four panels: **Authorized scope**, **Import passive data**, **Findings** and **Discovered assets**. ### What you can do here Add domains and address ranges to the scope and confirm that they belong to the company. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/IkRFm607oJwRfeo4boMLO_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Import certificate transparency results and exposure data. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/2TK3sgmPUZEHlUOdgMtMy_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Resolve the discovered names and link them to inventory devices and cloud resources. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/kRfCQjKcUdz9q-IGMQCi5_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} See the external assets and the findings. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/NbJYZ7R5gdzilKfqHx2Ho_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} ### Authorized scope A scope entry is a domain ( acme.example , which covers its subdomains) or an address range ( 203.0.113.0/24 , at most /16 in IPv4 and /32 in IPv6). An entry only counts after **Confirm ownership**: Hive records who confirmed and when. Everything outside the confirmed scope is ignored on import, and when an entry is removed or its confirmation withdrawn (**Withdraw confirmation**), the external assets that only it covered are deleted. ### Sources **Certificate transparency**: the JSON of a crt.sh query ( \[\{name\_value, issuer\_name, not\_after}] ). Each name in a confirmed domain becomes a subdomain with the issuer and expiry of its longest- valid certificate; wildcards count as the parent name. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/nNE_jypSFQK5mGyxbQ-on_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} **Exposure data**: Shodan search results ( matches with ip\_str , port , product , hostnames ) or Censys hosts ( result.hits with services ). An address in a confirmed range, or with a name in a confirmed domain, enters with its port, service and banner. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/XW5tlrVukzX4R_tO0PCyM_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} **DNS**: **Resolve DNS** looks up the addresses and the CNAME of each discovered name through the protected resolver of Hive. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/YYYJJY-QEpoK6rQYURx7p_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} ### Link to the inventory An external asset is linked to an inventory device when its address is one of the device addresses or its name equals the device host name or FQDN, and to a cloud resource (load balancer, instance) when its address is one of the resource public addresses. ### Findings **Expired certificate** (high) and **Certificate expiring in 30 days** (medium). ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/2IZqAj5XSLdsVDsoa7cSU_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} **Weak certificate** (medium): SHA-1/MD5 signature or RSA key smaller than 2048 bits, when the source tells. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/sZDojiTv1Zvn0XqmPYCXY_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} **Administration port exposed** (high): SSH, Telnet, RDP, SMB, WinRM, VNC, databases, Docker, Kubernetes API, kubelet and similar ports open to the internet. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/i-2Am3VWk68LZpkj92xqU_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} **Dangling DNS (takeover risk)** (high): the name has a CNAME but no address — risk of subdomain takeover. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/1DOr1KccLPrF5Nxjhk4Pt_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} **Unknown subdomain** (low): a name that resolves and matches no inventory device or cloud resource. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/Rj_o3ZQ8Fb0ZI6UHLONmg_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} ### Worked example: an exposed RDP and a forgotten blog 1. Open **Security › External surface**. In the **Authorized scope** panel, choose **Domain** in **Type**, type acme.example in **Value** and click **Add**; do the same with **Address range**203.0.113.0/24 . Click **Confirm ownership** on each line and confirm (needs integrations\:admin ). 2. Open https\://crt.sh/?q=%25.acme.example\&output=json in your browser, copy the JSON, paste it in **Certificate transparency (crt.sh JSON)** of the **Import passive data** panel and click **Import**: "4 imported, 1 ignored (outside the confirmed scope)." (a name of another company in the same certificate was ignored). 3. Paste a Shodan export for net:203.0.113.0/24 in **Exposure database (Shodan or Censys JSON) **and click **Import**: "1 imported, 1 ignored (outside the confirmed scope)." (an address outside the range). 4. Click **Resolve DNS**. www\.acme.example resolves to 203.0.113.20 , the server WEB-01 of the inventory. 5. The **Findings** panel shows **Administration port exposed** on 203.0.113.20:3389 , **Dangling DNS (takeover risk)** on blog.acme.example → acme.ghost-host.example and **Expired certificate** on old.acme.example ; in **Discovered assets**, www\.acme.example is linked to WEB-01 . Remove the DNS record of the blog and close RDP on the firewall. ### Pitfalls and limits Changing the scope, importing and **Resolve DNS** need integrations\:admin (without it the buttons and the import panel do not appear); viewing needs vulnerabilities\:read . ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/65R_g-OAlUq4vwoT27kXe_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} An address range wider than /16 in IPv4 (or /32 in IPv6) is refused: "Use an address range like 203.0.113.0/24 (at most /16)." ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/ye8Wjd0LbXFZB0rmkKZxa_image.png" size="10" isUploading="false" width="5" height="4" darkWidth="5" darkHeight="4" showCaption="false"} An entry without confirmation does nothing: imports return "0 imported" until someone confirms it. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/p-5tMavLVbGf_4U9SU1NH_image.png" size="10" isUploading="false" width="5" height="4" showCaption="false"} Hive does not fetch crt.sh, Shodan or Censys by itself in this version; you import their JSON. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/MNaqD2mL8gCKHolQy1p0v_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Ports and banners are only as fresh as the imported data; Hive does not check them. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/ZYTNUMLqyimx1_9WYuxMd_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Private ranges and internal addresses are not external surface; the resolver of Hive does not return internal addresses. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/iSLmkBTxBKDBX-h4es72I_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} ### Related Certificates ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/UcWQQ3hJdcUNof4Pi9Pay_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Cloud ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/PvPTLwcIM_y03hzbyDclG_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Code and CI/CD ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/gY_frzIt8vsQ086nRHIfZ_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Vulnerabilities ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/O5YoDCWzkDwbP8gwf3nqX_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} ### Cloud ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/dQyZY6kil_KXLvSKcY5DC_image.png" size="67" isUploading="false" width="672" height="426" darkWidth="672" darkHeight="426" showCaption="false"} Screen: Cloud Cloud reads your AWS, Azure, Google Cloud and Oracle Cloud (OCI) accounts with a read-only credential: networks, subnets, peering, VPN and gateways, instances (and which inventory device each one is), managed Kubernetes and managed databases, plus costs and flow logs when you give access to them. It is in **Discovery › Cloud**, with the tabs **Accounts**, **Topology**, **Resources** and **Costs**. ### What you can do here Connect an account with **Connect account** and follow its state in **Accounts**. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/zhmw9Rfb4vGeiCJOOkPBP_image.png" size="10" isUploading="false" width="5" height="4" darkWidth="5" darkHeight="4" showCaption="false"} Read an account again with **Read now**, or remove it with **Disconnect**. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/iXC1UCto2I9aGZ1p1E-JC_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} See the map of an account in **Topology** (VPC/VNet blocks, subnets, gateways, peering, VPN) and the traffic from the flow logs. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/YXIdld1Q9qPLflQ2CLvtf_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Search every resource in **Resources** by name, IP or address and filter by **Kind**. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/CA80sFGZvZBFzQCIJ4dw9_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} See the costs of the last 3 months in **Costs**. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/HyVfZswqTJ9MuhXcGDp-O_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} ### Step by step: connect an account 1. Open **Discovery › Cloud** and click **Connect account** (needs integrations\:admin ). 2. Choose the **Provider**. The note below says which read-only credential to create: 3\. **Amazon Web Services**: an IAM user (or role) with the ReadOnlyAccess or ViewOnlyAccess managed policy and an access key. Fill **Access key ID**, **Secret access key** and **Regions **(separated by comma; empty reads us-east-1 ). 3. **Microsoft Azure**: an app registered in Entra ID with a client secret and the Reader role on the subscription. Fill **Tenant (directory) ID**, **Application (client) ID**, **Client secret** and **Subscription ID**. 4. **Google Cloud**: a service account with the Viewer role on the project. Fill **Project ID** and paste the **Service account key (JSON)** as downloaded. 5. **Oracle Cloud (OCI)**: an API key for a user whose group has "read all-resources" on the compartment. Fill **Tenancy OCID**, **User OCID**, **API key fingerprint**, **API private key (PEM)**, **Regions** (empty reads us-ashburn-1 ) and, optionally, **Compartment OCID** (empty reads the root of the tenancy). 6. Optional fields: **VPC Flow Logs log group** (AWS), **NSG flow logs container** and its **SAS **(Azure), **Billing export table** (Google Cloud) and **Instance tags to copy**. 7. Give a **Name** (unique, up to 120 characters) and click **Connect**. The message "Account connected: the first read started." appears. The secret goes to the vault. The core reads each account through the provider APIs every hour. ### What is read **Networks** (VPC, VNet, VCN) with subnets, **peering**, **VPN** and gateways (internet, NAT, VPN). ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/MHrqz3UA5jAxQhLSWdOKG_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} **Instances** with private and public IPs and, when the provider reports them, MACs. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/fQltms8-X2I8efKunzT9R_image.png" size="10" isUploading="false" width="5" height="4" showCaption="false"} **Managed Kubernetes** (EKS, AKS, GKE, OKE) with the API address. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/UAjamo-U_CtwrIHb9MlHG_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} **Managed databases** (for example RDS, Azure SQL and flexible servers, Cloud SQL, OCI DB Systems) with their address. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/21esdZQ7Q7Q6SZd4VE488_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} If the credential cannot read a service, the rest is read and the account shows "Partially read: ..." with what was missing. ### Instances and the inventory Each instance is matched with an inventory device by MAC, IP or name, with the same rule as VMs: a value repeated on more than one device only decides if exactly one of them has the agent. The cloud does not create devices: an instance with no match stays "not in the inventory" in **Resources**. The device page shows the instance, its provider, account, region and network. ### Managed Kubernetes read with the cloud identity On a Kubernetes resource, **Read this cluster** connects it to **Kubernetes** with the address and CA from the provider and the identity of this account (EKS: token of the access key; AKS: Microsoft Entra token of the app; GKE: token of the service account), with the collector you choose. **Open in Kubernetes **appears once it is connected. The **Kubernetes** button of the account reads every managed cluster automatically after each cloud read. Example: "AWS prod" finds aurora-eks → **Read this cluster** →collector COL-SP-01 → the map, the service paths and the images show up; if the cluster refuses the key, the cluster page shows the aws eks create-access-entry and associate-access-policy commands with the ARN of the key. The same for AKS (role assignments to the app id) and GKE ( roles/container.viewer to the service account). Details in the Kubernetes article. For the lab, add sts to the per-service endpoints of the AWS account. ### On the Kubernetes map When a Kubernetes application points to a managed database (environment variable or ConfigMap), the logical map shows the database with its cloud name, account, region and network. The matched device gets origin tags: Nuvem: \ , Conta de nuvem: \ , Região: \ , Rede de nuvem: \ and the instance tags **Environment**, **Application**, **CostCenter** and **Owner **(plus the keys in **Instance tags to copy**, up to 20). They follow the origin: an instance that stops matching or a removed account takes them away; manual tags are never touched. ### Topology and flow logs In **Topology**, each VPC/VNet is a block with its subnets and what runs in each (instance, managed database, Kubernetes; blue name = matched to an inventory device), gateways on the edge, the link to the **Internet**, peering (dashed blue line) and each VPN to the on-premises address (green up, red down). With flow logs configured (AWS: the CloudWatch Logs group of the VPC Flow Logs in the default format, credential with logs\:FilterLogEvents ; Azure: the NSG flow logs container with a read-and-list SAS), every read turns accepted flows into the same per-minute traffic as the switches, used by the service path and the logical map. Rejected flows are only counted. The **Traffic from the flow logs **panel shows the last hour: who talked to whom, port and bytes. ### Costs With cost read access (AWS Cost Explorer; Azure Cost Management Reader), **Costs** shows the total of the last 3 months per provider, the most expensive services of the last month, the cost per cost center (AWS CostCenter tag) and per account. Connecting the AWS management account (read-only Organizations) lists the accounts of the organization with their OU path. On Google Cloud, give the **Billing export table** ( project.dataset.table ); the service account needs BigQuery Data Viewer and Job User, and costs come by service, by project and by the costcenter label. ### Worked example: read-only AWS account in two regions 1. In AWS IAM, create the user hive-reader with the managed policy **ReadOnlyAccess** and an access key. 2. In Hive, **Connect account**, **Provider** Amazon Web Services, **Name**AWS Production , **Access key ID**AKIA... , **Secret access key**, **Regions**us-east-1, sa-east-1 , **Connect**. 3. The row shows **Reading**, then **Read** with, for example, "4 networks · 37 instances (31 in the inventory) · 3 databases · 1 Kubernetes". 4. Click **Topology** on the row: the VPCs of both regions appear as blocks; vpc-prod-sa has 3 subnets, an internet gateway, a NAT gateway and a VPN to 200.10.20.30 (green). 5. In **Resources**, choose **Kind** Instance and search 10.50. : the 6 instances without a device are the ones with no agent and no discovery yet. Install the agent or scan that range and, after the next read, they show their inventory device. 6. Open a matched device: it has the tags Nuvem: AWS , Conta de nuvem: AWS Production , Região: sa- east-1 , Environment: prod . ### Worked example: flow logs on AWS 1. Publish the VPC Flow Logs of vpc-prod-sa to the CloudWatch Logs group /vpc/flowlogs/prod and add logs\:FilterLogEvents to hive-reader . 2. Connect the account (or a new one) with **VPC Flow Logs log group**/vpc/flowlogs/prod . 3. After the next read, **Topology** › **Traffic from the flow logs** shows "Last hour: ..." with the top conversations, for example 10.50.1.12 → 10.50.2.40 , port 5432. ### Pitfalls and limits Connecting, reading now and disconnecting need integrations\:admin ; viewing needs assets\:read . ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/RMbq_6K9jrCb7qUmBvVon_image.png" size="10" isUploading="false" width="5" height="4" showCaption="false"} AWS regions must be codes like us-east-1 (up to 30); OCI regions like sa-saopaulo-1 . ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/FyKoPOrY6idfjPep_131K_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} The Azure flow logs container URL goes without the SAS (the SAS has its own field and goes to the vault). ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/OEGicO6hs2iIGdtxA4SrJ_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} A new read cannot start while one is running ("The account is being read now."). ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/zUyJj0nJiV7uPUEJBNjQZ_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} **Disconnect** removes what was read and the secret in the vault, and the cloud origin tags leave the devices. Nothing changes in the cloud. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/40AHN8AMCNI_U7AQzoZeh_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} The screen has no edit form; changes to an account (new secret, regions, read interval of 15 to 1440 minutes) go through the API ( PUT /api/v1/cloud/accounts/ ). ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/S2YtImD8SOwEBHRozVKle_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} ### Cloud clusters in Maps A managed cluster read with the cloud identity behaves like any other: ConfigMaps stay off until **Read ConfigMaps (endpoints only)** is turned on under **Access** (only addresses leave the collector), and the cluster shows up as a **Source** of **Maps › Logical map** and in the starting points of **Maps › Service map**. When a published address of the cluster stops, the impact names the business service whose components are on its chain or whose name or description mentions the host. ### Worked example: aurora-eks in the Maps workspace 1. **Maps › Kubernetes** opens the logical map with the first cluster; choose **Source** › Kubernetes · aurora-eks · AWS . 2. Open the namespace shop : the RDS database prod-orders is the **common end** of the two published paths. 3. Click prod-orders : both Ingresses turn red and **Published services that stop** shows "business service: E-commerce". ### Related Kubernetes ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/mZqzJKHHJHaT-1GaPi562_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Service path and logical map ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/nEknMabpVyVtMTHliGejL_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Tags and groups ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/vKxn51uv3zJvazysMAxYo_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Virtualization ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/M1lGOPwlYvfDL-rK1AT9u_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} ### Cloud posture ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/WfEfsbZ_53Xn3SgIcGvie_image.png" size="67" isUploading="false" width="672" height="426" darkWidth="672" darkHeight="426" showCaption="false"} Screen: Cloud posture Cloud posture extends the read of your cloud accounts beyond compute: storage buckets, serverless functions, cloud IAM (users, roles and policies), load balancers, DNS zones and records, queues and topics, secrets managers (metadata only, never the values) and security groups. A rule pack checks their configuration and opens findings with severity, evidence and remediation, and each account gets a posture score from 0 to 100. It is in **Discovery › Cloud posture**, with the tabs **Resources**, **Findings **and **Score**. ### What you can do here See every resource beyond compute in **Resources**, filtered by **Type** (or by the type buttons with their counts), with the **Open findings** of each one and, for load balancers, the instances (and inventory devices) behind them in **Linked assets**. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/JAMu99y4-uzqGcXCzeOQn_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} Work the findings in **Findings**: filter by **Status** (**Open** by default) and **Severity**, read the **Evidence** and **How to fix**, **Accept risk** with a reason or **Reopen** it. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/89QuO28OHQEyuNBw9IXUh_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Compare accounts in **Score** and click **Evaluate now** to run the rules again (needs integrations\:admin ). ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/NzpnIza3-61bTvTe4JGYT_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Receive provider events (create, change, delete) so the account is read again without waiting for its interval. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/_e3HUJgxoSaGvtvGpS0Oe_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} ### What is read **Azure** (read directly through Azure Resource Manager on every read of the account, with the Reader role): storage accounts, function apps, load balancers, DNS zones and record sets, Service Bus namespaces, Event Grid topics, Key Vaults (metadata), custom role definitions and network security groups. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/4YYbYYmHWFJC-Ky9q4e5k_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} **AWS**: security groups are read live (EC2) on every read. Buckets, functions, IAM, load balancers, Route 53, SQS, SNS and Secrets Manager come from a **snapshot**: the output of the AWS APIs or AWS CLI sent to POST /api/v1/cloud/accounts//snapshot with the keys s3 , lambda , iam , elbv2 , route53 , sqs , sns , secretsmanager and securityGroups . Each snapshot replaces the previous one; the periodic read does not remove it. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/O5dWL9WjyB6LKOucDlHym_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Secrets: only name, rotation and dates. A snapshot that carries SecretString or SecretBinary is refused. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/7huZbqdrrIC4aXLNhP2xw_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} Load balancers keep the list of target instances; when the instance is matched to a device of the inventory, the device appears next to the balancer. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/XpY0eSy_r33HYwuR-RlVg_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/45CToI_knc8btNxEixUG0_image.png" size="10" isUploading="false" width="63" height="16" darkWidth="63" darkHeight="16" showCaption="false"} ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/7NzJyfit45qfmmrEH56qx_image.png" size="10" isUploading="false" width="33" height="16" darkWidth="33" darkHeight="16" showCaption="false"} ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/HBVZi73qXyDc-9fr05zMn_image.png" size="14" isUploading="false" width="140" height="16" darkWidth="140" darkHeight="16" showCaption="false"} ### The rules | **Rule** | **Severity** | **When it opens** | | ------------------------------------------------------------ | ------------ | -------------------------------------------------------------------------------------------------------------------------- | | Bucket readable from the internet | critical | public policy without Block Public Access (AWS) or allowBlobPublicAccess on (Azure) | | Bucket without default encryption | medium | no default encryption configured | | Admin port open to the internet (0.0.0.0/0) | high | 22, 23, 3389, 5985/5986, 1433, 3306, 5432, 6379, 9200 or 27017 allowed from 0.0.0.0/0 or \::/0 | | Console user without MFA | high | IAM user with console password and no MFA device | | Access key older than 90 days | medium | active access key created more than 90 days ago | | Function with a public URL without authentication | high | function URL with auth type NONE (AWS) or a function app open with no access restriction (Azure) | | Load balancer serving HTTP without TLS | medium | HTTP listener and no HTTPS/TLS listener | | DNS CNAME pointing to a cloud resource that no longer exists | high | CNAME to a cloud address (S3, CloudFront, ELB,
azurewebsites.net, blob, Traffic Manager...) that no read resource has | ### Status and score **Open**: the rule found the problem on the last evaluation. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/90dg0KzhZ78Q14Og-5qrv_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} **Resolved**: the problem is gone (fixed or the resource was removed). If it comes back, the finding is open again. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/GaDNp08dR-QeVaveXJHO7_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} **Accepted**: someone accepted the risk with a reason (needs integrations\:admin ). It no longer counts in the score; **Reopen** puts it back. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/LOMFy64Ldrex42p9EtQfi_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} The score starts at 100 and loses 20 per critical, 10 per high, 4 per medium and 1 per low open finding, never below 0. It is recalculated after every read of the account, after a snapshot, after accept/reopen and on **Evaluate now**. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/FwxJeTOJmPc2w2Tug12xs_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} ### Events from the provider 1. Create the webhook token with POST /api/v1/cloud/accounts//event-token . The token is shown only once; creating it again replaces the old one. 2. Point the provider to POST /api/v1/public/cloud-events with the header X-Hive-Cloud-Token : 3. **AWS**: an EventBridge rule for "AWS API Call via CloudTrail" with an API destination to Hive (the CloudTrail file format with Records is accepted too). 3. **Azure**: an Event Grid subscription on the subscription with a webhook endpoint; the validation handshake is answered and the key can also go in the aeg-sas-key header. 4. Each event is kept (source, action, name and resource) and marks the resource and the account for refresh. The scheduler reads the account again within about 5 minutes. ### Worked example: public bucket and open SSH on AWS 1. The account AWS Production is already connected in **Discovery › Cloud**. 2. Export the inventory with the AWS CLI (for example aws s3api list-buckets , get-bucket-policy-status , get-bucket-encryption , aws lambda list-functions , aws iam get-account-authorization-details , aws elbv2 describe-load-balancers , aws route53 list-resource-record-sets ) and put the results in one JSON with the keys of the snapshot. 3. Send it with POST /api/v1/cloud/accounts//snapshot . The answer counts what was read, for example 3 buckets, 2 functions, 3 IAM users and 2 load balancers. 4. Open **Discovery › Cloud posture › Score**: AWS Production shows 28, with 1 critical, 4 high and 3 medium. 5. In **Findings**, the critical one is "Bucket readable from the internet" on aurora-public-site ; the evidence shows publicAccess: true and the remediation says to turn on Block Public Access. 6. "Admin port open to the internet (0.0.0.0/0)" on legacy-admin shows 22 from 0.0.0.0/0 . Restrict the rule in AWS to the VPN range. 6. Create the event token and the EventBridge rule. The change of the security group arrives as AuthorizeSecurityGroupIngress / RevokeSecurityGroupIngress , the group is marked for refresh and, after the next read, the finding goes to **Resolved** and the score rises. 7. The bucket aurora-public-site is a public site on purpose: click **Accept risk**, write "Public website, no sensitive data" in **Why is the risk accepted?** and click **Accept risk** in the dialog. The score no longer counts it. ### Pitfalls and limits Sending a snapshot, accepting, reopening, **Evaluate now** and creating the event token need integrations\:admin ; snapshots are for AWS accounts only (an Azure account is refused with "Snapshots are for AWS accounts; Azure is read directly."). ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/34ksgDVGdmcgaAAbk_eQj_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} On AWS, only security groups are read live in this version; the other kinds depend on the snapshot. Send a new snapshot to update them (an event only marks them for refresh). ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/p6cSbAL5VX_GpBSl-dYiC_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Azure needs the Reader role on the subscription; a type the account cannot read is skipped and the rest is read. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/isSw2b9Y6BSuGznk844yY_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} The dangling CNAME rule only knows the resources Hive read: a CNAME to a bucket of another account you do not connect looks dangling. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/Z7R_Zdq-NO9ngOCGMJxXt_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} The webhook only accepts a valid token of the account; at most 500 events per call. Events do not change resources by themselves: the next read decides. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/NOpTLhFTjFBOy7SNK7w_p_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Accepted findings close by themselves when the resource is fixed; accepting is not a permanent exception for new resources. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/bTFRHQKaMORaJt6Xplfnj_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Access keys appear only by their last 4 characters in the evidence; secret values are never read nor stored. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/smTwv6FYX9wf6J2qgzyjv_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} ### Related Cloud ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/HGO9Qx5rY11AeRgbR4ZjK_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Vulnerabilities ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/lV70LU5fuEiHr8RsFz3OI_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} Compliance ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/QNuzYfaL3uxQhdjLYByfD_image.png" size="10" isUploading="false" width="5" height="4" darkWidth="5" darkHeight="4" showCaption="false"} Integrations center ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/-IoKRJJ0Iw8SC7IPfRTc0_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} ### Service path and logical map ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/7W03IM0je5q6Arv1zgRjv_image.png" size="67" isUploading="false" width="672" height="426" darkWidth="672" darkHeight="426" showCaption="false"} Screen: Service path and logical map (1/2) ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/9t_ovClXZvJPksBjmZefw_image.png" size="67" isUploading="false" width="672" height="423" darkWidth="672" darkHeight="423" showCaption="false"} Screen: Service path and logical map (2/2) Two maps show how a service works. The **Logical map** (**Maps › Logical map**) shows how each business service reaches the data, layer by layer, and suggests the devices the service uses that are not components yet. The **Service path** (**Maps › Service map**) goes from a published address or a business service down to the switch port: where each hop runs, the physical path, single points of failure and what stops if something goes down. ### What you can do here On the **Logical map**: choose a **Business service** (or **All**), switch the **Direction** between **From service to data** and **From data to service**, click a point to see what it **Depends on** and who it is **Used by**, and turn on **Impact analysis**. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/sv83sseDr_IaYzhz_FaaJ_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} Approve or turn down the **suggested components** of a business service, right on the map. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/F297soV6FumCucxWzTmzp_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} On the **Service path**: choose a **Starting point** and switch the **View** between **Physical**, **Logical (traffic)**, **Overlay (where it runs)** and **Overlay with traffic**. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/jBwBNfWlWstzzOCeYbT9f_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} See the **Single points of failure**, the **Physical path between hops** and whether the traffic goes through the expected path. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/HUsUlb3JPk3Wrvwdz9nfq_image.png" size="10" isUploading="false" width="5" height="4" showCaption="false"} ### The logical map The columns are the layers **Business service**, **Application**, **Ingress and API**, **Microservices**, **Messaging and cache** and **Data**. Each link says where its evidence came from: **Registered in Hive **(components of the service), **OpenTelemetry tracing**, **Kubernetes API**, **Cloud API**, **Traffic seen by the agent**, **Traffic seen by the switches (NetFlow)**, **Session open in the database**, or **Suggested —waiting for approval** (dashed). A machine where personal data was found is marked **Contains personal data — LGPD**. 1. Open **Maps › Logical map** and pick the service in **Business service**. 2. Click a point: the side panel shows its layer, health, **Depends on (n)** and **Used by (n)** with the evidence of each link. 3. Click **Impact analysis** to light up everything that falls if this point falls; **Hide impact** turns it off. **Open** goes to the device or object. ### Suggested components (automatic expansion) With a business service chosen, the map grows by itself from the service's components: The core starts from the registered components and follows their **outgoing** traffic for up to **3 hops**, using what each machine's **agent** saw, the **NetFlow/sFlow/IPFIX** the switches send to the collector and the **sessions open in the observed databases** (PostgreSQL, SQL Server, MySQL and Oracle report where their sessions come from). Evidence from the last 7 days counts. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/kM_lRtRMa8eu9zT9txIE9_image.png" size="10" isUploading="false" width="5" height="4" showCaption="false"} Each device found becomes a **suggested component**, drawn dashed and linked to who calls it, with a role: application, database, or messaging and cache. The top bar shows "n suggested". ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/Lsm0ovu8kYBgjdECe77_P_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} **Approve** turns the device into a component of the service, and the search continues from it right away. **Turn down** removes it; it is not suggested again for this service until someone **restores** it on the service page. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/W3-LDxIYE0JEC1vkUdVQz_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} Left out as noise: infrastructure ports (DNS, Active Directory, SMB, RDP, SSH, management, updates, printing), ephemeral ports (49152 and up), rare conversations (fewer than 2 connections ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/LXW9eTkoMUEOaxw_UR_Be_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} in the week, except database sessions), collectors, devices turned down and IPs shared by several devices. Databases and shared resources (used by 25 machines or more, shown as "shared: used by n devices") are suggested, but the search does not continue from them. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/46GpuWn17eL84Gb2Mz09s_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} The search runs every 15 minutes; **Search now** on the service page runs it at once. A pending suggestion with no evidence in the last 7 days disappears by itself. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/Vc4tLjfMEbgCIWLrofJRj_image.png" size="10" isUploading="false" width="5" height="4" darkWidth="5" darkHeight="4" showCaption="false"} ### Worked example: expand the "E-commerce" service The business service **E-commerce** has one component: the web server web-shop-01 . 1. Open **Maps › Logical map**, **Business service**E-commerce . The bar shows "2 suggested": db- orders-01 and bkp-srv-02 , both dashed. 2. Click db-orders-01 . The panel shows **Suggested component**, "web-shop-01 talks to it on port 5432", "1 hop(s) from the components" and "Seen by agent traffic, database session". Click **Approve**: "db-orders-01 is now a component of the service". The link becomes solid and the search continues from db-orders-01 (a database, so nothing new comes from it). 3. Click bkp-srv-02 ("web-shop-01 talks to it on port 10000", seen by switch NetFlow). It is the backup server, not part of the service: click **Turn down**. "bkp-srv-02 will not be suggested again for this service" and it leaves the map. 4. A month later the team decides the backup server is part of the recovery plan. Open **Monitor ›Availability and capacity**, the service **E-commerce**, panel **Suggested components**, **Turned down (1)**, and click **Restore** next to bkp-srv-02 . The search runs again and, if the traffic is still there, it comes back as a suggestion. Approving, turning down and restoring need alerts\:admin and are recorded in the audit log. ### The service path 1. Open **Maps › Service map** and choose the **Starting point**: an address **Published in Kubernetes** (Ingress or route) or a **Business service**. 2. The top shows the **logical hops** (publication → Service → workload → database) and, below, **where each one runs**: Kubernetes node, VM and host, port and switch (read by SNMP), or the cloud network and the VPN the traffic leaves through. 3. Switch the **View**: 4\. **Physical**: the connection tree with everything that sustains the service lit, from machines and VMs up to the Internet; what is outside the local network (cloud, VPN) is listed below. 4. **Logical (traffic)**: entry → web → api → database, with the Service each link goes through and the color of the traffic verdict. 5. **Overlay (where it runs)**: the logical path on top and, under each step, where it runs. 6. **Overlay with traffic**: one card per pair of hops with **Expected path** and **Observed**, and a verdict: "on the expected path", "outside the expected path", "left the host (expected inside it)", "inside the host, nothing leaving", "seen at the endpoints only (no flows)" or "no evidence yet". 7. Read **Single points of failure (n)**: an element with a red border takes the service down on its own (application and database on the same host, node or switch; the only place something runs; an element that carries several hops). Replicas on other nodes, another host or two VPN tunnels count as redundancy; for a business service, the redundancy groups (minimum up) apply. 9. Click any element (port, switch, host, VM, node, VPN): "The service stops" or "The service keeps running", with what stops and what only loses capacity. The links **Logical map**, **Physical map**, **Virtualization** and **Cloud topology** open the other maps. **Physical path between hops** says, for each pair, whether the traffic stays on the same physical machine, on the same switch, or which switches it crosses (LLDP/CDP neighbors). ### Worked example: single point of failure in the shop 1. **Starting point**loja.aurora.lab (Published in Kubernetes). 2. **Overlay (where it runs)** shows api and postgres on the same VM k8s-node-02 , which runs on the host esx02 . Both get a red border: **Single points of failure (2)**, reason "application and database together". 3. Click esx02 : "The service stops — Stops: api, postgres." 4\. Switch to **Overlay with traffic**: the pair web → api shows "on the expected path" (green), the pair api → postgres shows "inside the host, nothing leaving". 4. Move a replica of api to another node; after the next cluster read, api loses the red border. ### Pitfalls and limits Without switches read by SNMP the physical path shows "The topology does not reach these machines yet (read the switches by SNMP)." ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/bh9WEq7h96-PMz2a4VKwc_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Observed traffic needs NetFlow/IPFIX/sFlow sent by switches and routers to the collector (UDP 2055), the agent's connections, or cloud flow logs. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/hyzGB0ukttHotYeUMEoI2_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Suggestions appear only for business services that have at least one component; the search stops at 200 candidates. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/srjVXiygCK3yYp3XEWsr7_image.png" size="10" isUploading="false" width="5" height="4" showCaption="false"} Viewing the maps needs assets\:read ; the suggestions list on the service page needs alerts\:read . ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/ka1F9hFW-Nhnb7Otcjhfs_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} ### Source of the logical map **Source** chooses what the logical map shows: **Business services** (the map above) or a Kubernetes cluster of any origin, cloud ones included. A cluster opens the same map as the cluster page —orientation, **Levels**, the dependency panel and the impact on the map — with links to its service paths. The **Maps › Kubernetes** shortcut opens the first cluster. ### The Complete view **Complete** is the default view of the service path: the whole chain in one map, in the bands **Published ·Service · Workload · Dependencies · Where it runs · Network**: entry (host, TLS) → Service (ports) →workload (replicas) → pods; its dependencies (databases, Kafka/Redis, Services of the same or other namespaces, external services), with the traffic seen colored on the links; where it runs (Kubernetes node → VM → hypervisor host) and the switch port and switches when known. Single points of failure carry the **SPOF** tag; clicking an item of **Single points of failure** or of the issues list focuses the node on the map. Clicking any node paints the impact (red stops, orange loses capacity, gray uses, blue depends on). Where the chain stops for lack of data, the last node says why: **switch port unknown**, **ConfigMaps not read: dependencies written in them are not seen**, **Service without endpoints**, **0 replicas**, **VM or machine of this node not found in the inventory**. **Logical** filters the map to the logical chain and **Physical** to where it runs and the network; **Overlay** and **Overlay with traffic** stay as before. ### Choosing the starting point The **Starting point** is searchable (host, namespace or name) and grouped by cluster when there is more than one. Each published host is one item ("aura-lab.corp · 4 entries") that opens all its paths together, converging on the shared hops; below it, each entry is a sub-item such as /api → labs-hyper/hyper-api-ingress · Ingress (Ingress, OpenShift routes and HTTPRoutes) that opens only that path. ### Worked example: itsmx-hom in one map 1. Search itsmx and choose itsmx-hom.centralit.com.br · 2 entries . 2. **Complete** shows Ingress → Service → Deployment itsmx → 2 pods → node citdfsrv237 → VM CITDFSRV237 → host 172.20.5.115 → **switch port unknown**; the host carries **SPOF**. 3. The Deployment redis in hml-tools ends in **ConfigMaps not read: dependencies written in them are not seen**; turn on ConfigMap reading in the cluster if needed. 4. Click 172.20.5.115 in **Single points of failure**: the map focuses on it and paints the whole chain red. ### Export the map as an image Every map (service path, logical map, network, Kubernetes, virtualization, org chart and the map builder) has **Image (PNG)** and **Image (SVG)** in its bar. The file holds the whole map at full size — not only the part on screen or the current zoom — in the colors of the theme in use, with the title (and the starting point) and the date at the top. The image is made in the browser; nothing is sent to the server. PNG is sharp for documents and chats; SVG keeps every detail when zoomed and opens in any browser or editor. ### Worked example: attach the itsmx-hom path to a change 1. Open **Maps › Service path**, choose itsmx-hom.centralit.com.br and keep **Complete**. 2. Click a node (for example the host) so the impact is painted; the export keeps the colors. 3. Click **Image (PNG)**: the browser saves service-path-itsmx-hom-centralit-com-br-\.png with "Service path · itsmx-hom.centralit.com.br" and the date at the top. 4. Attach the file to the change or to the incident. For a printed A3 or a slide that will be zoomed, use **Image (SVG)**. ### Export the whole page (HTML and PDF) In **Maps › Service path**, **Export page** (next to the view buttons) saves the whole page, not only the image: the title, the starting point, the view, the date, the map, the legend, "How to read this map" and the panels below it (single points of failure with what each carries, physical path between hops, problems on the links, where the chain stops, what stops if each element fails and, when there is traffic, whether it goes through the expected path). **Interactive HTML** downloads one .html file that opens in any browser, also offline (no internet, fonts or external addresses). When it opens, the path is drawn from the entry to the last hop (no animation when the system asks to reduce motion; **Replay the path** draws it again). Click an element to paint its impact with the same colors as the console (red stops, orange loses capacity, gray uses it, blue is what it depends on) and see its details, what happens if it fails and tips; click an item of a list to focus it on the map; the wheel zooms, dragging moves and Esc clears. Light or dark follows the system of whoever opens it; the map keeps the colors of the theme used to export it. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/3x2UNVQ3MlbEyISrCYwSL_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} **PDF** opens the print dialog with the page laid out for paper (A4 landscape: the map fitted to the page width on the first page, the panels after it); choose **Save as PDF**. If the browser cannot print the page directly, it downloads the print-ready file instead, which opens the dialog by itself. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/E8Bx4Q4bVjVulegG_EngR_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} The export asks the core for the impact of each element (the same answer as clicking it), so it may take a few seconds on large paths. The map is exported without the current selection; in the file, clicking is what paints the impact. For now the page export is on the service path; the other maps keep **Image (PNG/SVG)**, **draw\.io** and **Visio**. **Worked example: send the itsmx-hom path to the infrastructure team** 1. Open **Maps › Service path**, choose itsmx-hom.centralit.com.br and keep **Complete**. 2. Click **Export page › Interactive HTML**: the browser saves service-path-itsmx-hom-centralit-com- br-\.html . 3. Send the file. Whoever opens it watches the path being drawn, clicks host 172.20.5.115 in **Single points of failure** and sees the chain painted red, "Single point of failure: carries …" and the tip to add redundancy. 4. For the change record, click **Export page › PDF** and choose **Save as PDF**: the map is on the first page and the panels follow. ### Related Business services, SLA and capacity ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/rV0X4bZjZM6uu9QfwouyH_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Map builder ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/qczbje8mAunmd1mT1vOfn_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} Network map ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/KUI0eugQdb3RX2wzBS5R9_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Kubernetes ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/cy_V98n3JU-UBD6nlguKM_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} Virtualization ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/e8kIw7B86X7PWzP9sxjVX_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} Cloud ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/YgX2ZYe_OEVpjWLrORSDA_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} ### Map builder ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/vKZBaRXagofgAKfig1vDo_image.png" size="67" isUploading="false" width="672" height="426" darkWidth="672" darkHeight="426" showCaption="false"} Screen: Map builder The map builder lets you draw your own maps from what Hive already knows: drag a device to the map and what is one level above it (what it depends on) and one level below (what depends on it) comes along, already linked. Save maps for the NOC, a service or an incident. It is in **Maps › Map builder**. ### What you can do here Start a **New map** or open a saved one in **Map**. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/lV70LU5fuEiHr8RsFz3OI_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Find devices and services in the list on the left (**Search** by name, model or user) and drag them to the map, or use **+** to drop one in the middle. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/QNuzYfaL3uxQhdjLYByfD_image.png" size="10" isUploading="false" width="5" height="4" showCaption="false"} Bring more relations with the **+n** buttons above and below each box, or **Bring its relations** in the panel of a selected item. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/OJT_AEPT4MHfCnKxFgO1h_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Move boxes, pan the map by dragging the background, zoom, **Fit to screen** and **Arrange**. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/F29HbLol4ixeu08ertYlo_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} **Save map**, **Clear** the drawing or **Delete map**. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/VFva2gqAJnzE5OoMzD3ZF_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Open the map in **Full screen** or **Open in new tab** for a NOC screen. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/CDhkGneOTGk4k9sEh8tCv_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} ### Step by step: build and save a map 1. Open **Maps › Map builder**. **Map** shows **New map**. 2. In the list on the left, items are grouped by kind (Device, Network device, Virtual machine, Internet exit and the logical layers such as Business service, Application or Data); the dot shows the health. Type in **Search** to filter. 3. Drag an item to the map area (or click its **+**). It lands with its relations: the message says, for example, "erp-app-01 brought esx02 (above), erp-db-01 (below)." 4\. Each box shows **+n** above ("Bring n above (what it depends on)") and below ("Bring n below (what depends on it)") while it still has relations not on the map. Click them to grow the map one level at a time. 4. With **Group by type** on, 3 or more items of the same kind coming from the same box enter as one group box ("Device (12)"); click **+** under the group, or **Open the group into items** in its panel, to place them one by one. 5. With **Arrange automatically** on, the map is laid out in levels and fitted to the area after each addition. Turn it off to keep your own positions; **Arrange** lays it out once. 6. Click a box to see its panel: "n above it (what it depends on) · n below it (what depends on it)", the lists **Above (depends on)** and **Below (used by)** (with "not on the map" for missing ones) and, for devices, their ports. **Remove from the map**, the **×** on a box or the Delete key takes it off the map. 8. Type a **Name** and click **Save map** (needs assets\:write ): "Map saved with n items." The address changes to the saved map. Lines: solid for a **physical link** (LLDP/CDP, switch port, VM on host), dashed for a **logical dependency **(service, application, database). ### How saved maps behave A saved map keeps only the items and their positions. The links are drawn from the current topology and logical map every time it opens, so a link that no longer exists is never shown. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/qmrS1Y-imPxuE5kvEtgMO_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} An item that left the topology stays in place marked **No longer in the topology**; remove it with **×**. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/-_y2Ra8H4s_PMKalb1bA9_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Saved maps are shared: everyone with assets\:read can open them; saving and deleting need assets\:write . ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/rMCimNoG9U3oh2n8FH5oV_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} **Delete map** removes only the drawing; the devices and their links stay as they are. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/dhc1AhrXYKVmT3NurSWFv_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} ### Worked example: ERP path for the NOC 1. **Maps › Map builder**, **Search**erp-app , drag erp-app-01 (a VM) to the center. 2. It brings what is above it, the host esx02 (physical link) and the business service ERP (dashed, logical), and what is below it, the database server erp-db-01 : "erp-app-01 brought esx02 (above), ERP (above), erp-db-01 (below)." 3\. erp-db-01 shows **+1** above: click it to bring erp-app-02 , the other application server that uses the database. Click **+1** above esx02 to bring the switch SW-CORE-01 , and above the switch to bring the **Internet exit**. 3. Click **Arrange**, then **Fit to screen**. 4. **Name**ERP path , **Save map**: "Map saved with 7 items." 6\. On the NOC computer, open **Map** › ERP path and click **Full screen**. The dot of each box shows its health (green, yellow or red), as read when the map was opened; reload the page to refresh it. ### Worked example: map for an incident 1. **New map**, drag SW-FLOOR2-01 . With **Group by type** on, the 24 devices plugged into it come as one box "Device (24)". 2. Click the box, **Open the group into items**: "24 items placed." 3. Remove the printers with **×**, **Name**Incident floor 2 , **Save map**. 3. After the incident, **Delete map** › confirm "Delete the map "Incident floor 2"?". ### Pitfalls and limits **Save map** is enabled only with a name and at least one item; names must be unique ("There is already a map named ..."). ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/opNm-E8ZsrhcDHsJEJlB8_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} A map holds up to 500 items. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/KxrYG9ttJLbxZvLSrLsz0_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Zoom goes from 40% to 250%; **Actual size** goes back to 100%. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/FRO2bW9diZ_4l6ohAJsBz_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} An unsaved map opened in a new tab starts from the draft of this browser; save it to share it. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/W5XD0ns32-3TL1QO3PxGR_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Neighbors outside Hive (seen only by LLDP/CDP) are not listed to drag, but can come along as relations. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/ywygCrxhjL-OPXDFkyBgX_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} ### Related Service path and logical map ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/uMoMaDrLVH5Mwh4EZ1DrO_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Network map ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/ePJO_hMrPTM34KVHiuFrc_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Virtualization ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/_zU_4aFEPLfM28rhyNK6f_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Business services, SLA and capacity ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/3I3niOGlHVgQJ2k7f_dGL_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} ### Graph and Cypher queries ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/iL6ttu2cSp9ftDozej1K__image.png" size="67" isUploading="false" width="672" height="426" darkWidth="672" darkHeight="426" showCaption="false"} Screen: Graph and Cypher queries The graph puts what Hive already knows in one place: assets, the software installed on them, their open vulnerabilities, business services, sites, agents, Kubernetes objects and virtual machines, all linked. You query it with Cypher, the graph query language, or ask a question in plain words and let the AI write the query for you. It is in **Maps › Graph**. ### What you can do here Run a **Cypher query** and see the **Result** as a **Table** and as a **Graph view**. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/nmu4z24OOb3yRTDgf5yxI_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} Start from the **Examples** (exploited vulnerabilities, most installed software, services by open CVEs, who talks to whom, Kubernetes nodes, virtual machines). ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/bVWdFiIiXpon56D638siY_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} **Ask in natural language**: the AI writes the query, Hive shows it and runs it. **Only show the query** writes it without running. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/1M3-9lRINQRK0-fUt1uFv_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} **Save query** with a name and open it again from **Saved queries**. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/2KcbEQlS6FzcacCbQxkuT_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} **Rebuild now** to load the graph from the inventory right away; it also loads by itself every 15 minutes. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/YQ19PnlgYkErC4O8mWCuC_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Read **Labels and relationships** to see what you can query. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/uJeB4gOOPsfCHQb7S0_G3_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} ### What is in the graph | **Label** | **Comes from** | | ---------------------- | --------------------------------------------------------------------- | | Asset | the inventory (computers, servers, network devices, virtual machines) | | Software | installed software, one node per name | | Vulnerability | CVEs with open findings; kev: true when in the CISA KEV catalog | | Service | business services | | Site | sites of the company structure | | Agent | Hive agents | | K8sCluster , K8sObject | Kubernetes clusters and what was read from them | Relationships: INSTALLED (asset to software), AFFECTED\_BY (asset to vulnerability), PART\_OF (asset to service), LOCATED\_IN (asset to site), RUNS\_ON (agent to asset), IN\_CLUSTER (Kubernetes object to cluster), HOSTED\_ON (Kubernetes node or virtual machine to its machine) and CONNECTS\_TO (asset to asset, from the connections seen by the agent). **Worked example: services exposed to exploited vulnerabilities** 1. Open **Maps › Graph**. The line under the title shows when the graph was loaded, for example "Loaded 3 minutes ago: 1,214 nodes, 9,870 edges." 2\. In **Examples**, click **Business services by open CVEs**. The query appears in **Cypher query**. 2. Change it to keep only exploited vulnerabilities: | MATCH (v\:Vulnerability \{kev: true})\<-\[:AFFECTED\_BY]-(a\:Asset)-\[:PART\_OF]->(b\:Service) | | ---------------------------------------------------------------------------------------------- | | RETURN b.name AS service, a.name AS asset, v.cve AS cve ORDER BY service | | ------------------------------------------------------------------------ | 1. Click **Run**. The **Table** shows one row per service, asset and CVE, with "n rows in n ms". 2. To see the shape, return whole nodes: change the last line to RETURN b, a, v and **Run**. Open **Graph view**: services, assets and CVEs are drawn as circles linked by their relationships. 3. Type KEV per service in **Name of the query** and click **Save query**: "Query saved." ### Worked example: ask in natural language 1. In **Ask in natural language**, type: Which machines have OpenSSL installed? 2. Click **Ask and run**. Under "Query written by the AI", Hive shows the Cypher it ran, for example | MATCH (a\:Asset)-\[:INSTALLED]->(s\:Software) WHERE toLower(s.name) CONTAINS 'openssl' RETURN a.name AS | | ------------------------------------------------------------------------------------------------------- | asset LIMIT 100 . 3. Check the query and the **Table**. To adjust it, click **Run** after editing it in **Cypher query**. 4. If the AI writes something that is not allowed (for example a query that changes data), nothing runs: the query is shown with the reason, so you can fix it. ### Pitfalls and limits The graph is **read-only**: CREATE , MERGE , SET , DELETE , DETACH , REMOVE , CALL , LOAD , FOREACH , DROP and YIELD are refused (use only MATCH , OPTIONAL MATCH , WHERE , WITH , UNWIND , RETURN , ORDER BY , SKIP and LIMIT ), and the query runs in a read-only transaction. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/o_QfmEWxX3x549Rq9SGyw_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} A query returns up to 1,000 rows and stops after 10 seconds. Use LIMIT and narrow the MATCH . ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/rwmw4DC3mAHC7BIEAAkT8_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} The query must end with RETURN and list the values (up to 20 columns; AS names the column, as in RETURN a.name AS asset ). RETURN \* and parameters ( $name ) are not accepted, and neither are semicolons inside the query (one at the very end is ignored). A query has at most 4,000 characters. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/z_u9KMVHZWT-529hoFa-i_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Text comparison is case sensitive. Use toLower(s.name) CONTAINS 'text' for names. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/4rQQbDViEIc0cJ0ssdqxO_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} The graph is a copy of the inventory loaded every 15 minutes (or with **Rebuild now**); a change made a minute ago may not be there yet. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/3Jt6SvjNe_pTaCbVZb2vt_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} The graph covers the whole estate, so people whose profile is limited to some sites, tags or groups cannot query it. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/B_5o_bENpPMIk2GHF961C_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} **Ask in natural language** needs the AI turned on in **Monitor › AI recommendations › Settings **and an AI provider connected in **Integrations › Integrations Center**; otherwise Hive says why it cannot ask (AI turned off, no provider connected or the monthly AI limit reached). The question goes to the provider, the data does not: the AI sees only the list of labels and relationships. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/g42VT7ICpoa835dT6PhDt_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} Every query, question and generated query is recorded in **Admin › Audit trail**. ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/B20f-BWz6pXdV_f-kqwBB_image.png" size="10" isUploading="false" width="5" height="5" showCaption="false"} ### Related Map builder ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/xKgM5wPsTchrxTB7b1B9E_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} Service path and logical map ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/U9yt1wlB1G_GR0Q1n2p71_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} Vulnerabilities ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/vqIyMXdsmkmoa2olzLMQ8_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} AI ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/MsDVMh-VKSNEeTsAdV6ap_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"} Audit ::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/jcU_WIhfQa6Rf6A5hVVJg_image.png" size="10" isUploading="false" width="5" height="5" darkWidth="5" darkHeight="5" showCaption="false"}