Application Discovery

Application discovery in Zluri identifies applications used across the organization by processing data from multiple sources. Discovered applications are added to the application inventory based on predefined source logic and matching rules.

Discovery Sources

Zluri discovers applications from the following sources:

• Single Sign-On (SSO) providers

  Examples include Azure AD, Google Workspace, Okta, OneLogin, and JumpCloud.

• Direct Integrations

• Manual additions

• Transactions

• Agents

• Mobile Device Management (MDM) systems

• CASB tools

• Plugins

Each source contributes application identifiers based on the type of data it provides.

Folders Used for Discovery

Zluri processes data from the following folders to detect applications:

• List of Applications (from SSO providers)

• Application Users

• Activity

• Transactions

  Disabled by default. Can be enabled if required.

Discovery Behavior by Source

Application discovery differs based on the source:

SSOs

• Application list
• Application user APIs
• Application user activity data

Direct Integrations

• Integration-specific application names

Transactions

• Transaction descriptions

MDMs

• Installed application lists on managed devices

Browser Agents

• Website URLs

Desktop Agents

• Application usage patterns

Application Matching Logic

When Zluri receives an application name, description, or pattern, it attempts to match the application against the global application database using the following logic:

• Direct name match in orgapp
• Exact match
• Alias exact match
• Direct match in globalapp
• Cupid mapping in orgapplication/globalapp
• Cupid mapping in global applications

Applications discovered from transactions or contracts are not added to the application inventory.

Browser-Based Detection Patterns

For browser-based discovery, Zluri uses the following patterns:

• Organization domain pattern
• Global domain pattern
• Application links
• Entity-level breakdown

Application Status Assignment

Application status is assigned based on the discovery source:

• Direct Integration

  Status is set to Active

• SSOs

  Status is set to Provided by SSO

• Other sources

  Status is set to Active

• Manual additions

  Status is set during manual addition and cannot be changed

Primary Source Priority

Each discovered application is associated with a primary source.

Priority rules:

• The first detected source becomes the primary source
• Direct Integration or SDK takes priority over other sources
• Manual source always has the highest priority

If a direct integration is removed, the primary source association is also removed.

Status Change Log

Zluri records source-level changes in the status change log.

This log tracks changes related to application discovery and source updates.

Application Name Normalization

Zluri normalizes application names received from APIs before matching them against the database.

Normalization behavior:

• Uses fuzzy matching logic
• Removes special characters for consistency

Example:

Slack # is normalized and displayed as Slack.

Removed Characters

The following special characters are removed during normalization:

\ ` ~ ! @# $ % ^ & * ( ) - _ + = | [ ] { } ' " : ; < > , ?

---