Reference

Discovery sources

ServiceMatch ingests multi-source discovery exports and reconciles them into one governed record set. Sources are role-typed: discovery sources establish that devices exist; enrichment feeds add fields; application feeders carry attribution evidence. The role decides what a source is allowed to do. What each source contributes field-by-field is measured in Field coverage & gaps.

Source family	Role	Identity notes
Microsoft Intune	Discovery	Strong serials and hostnames for the managed endpoint estate.
SCCM / Configuration Manager	Discovery (report family)	Hardware inventory carries serials and asset tags; software and services reports feed application evidence.
Nexthink	Discovery	Endpoint telemetry with solid device identity and rich installed-software context.
ScienceLogic	Discovery	Infrastructure and network estate; device-class signals for non-endpoint CIs.
Tanium	Discovery	Endpoint estate with strong identifiers.
LogicMonitor	Discovery	Monitored infrastructure; hostname-led identity.
Microsoft Entra ID	Enrichment	Directory and ownership context; enterprise-app assignments feed SaaS visibility. Never creates devices.
Active Directory (computer objects)	Corroborating	Confirms existence and staleness signals; deliberately not trusted to create records on its own.

Adding a source

New sources are registered through a governed onboarding path: header-based detection, column mapping to canonical fields, a role decision, and a precedence position — each landing on the decision record. Monitoring-platform exports (APM and infrastructure tools) follow the same path, with their role set by what their data can actually support: host inventories with weak hardware identity register as identity-capped discovery or enrichment; application-topology exports register as feeders.

Design Principle

A source's privileges follow its evidence, not its brand. A feed without serials or MACs cannot anchor identity, no matter how good its dashboards are — and a topology export that names containers is application evidence, not a device inventory.