Application Discovery

Current Behaviour

Application discovery in Zluri can happen from the following sources:

• SSOs (Azure, Google Workspace, Okta, OneLogin, JumpCloud, etc.)
• Direct Integrations
• Manual
• Transactions
• Agents
• MDMs
• CASBs
• Plugins

Folders Used for Discovery

Zluri processes data from these folders to identify applications:

• List of Applications (SSOs)
• Application Users
• Activity Folder
• Transactions (disabled by default, can be enabled if needed)

Application Discovery per Source

• SSOs

  • List Applications
  • Application User APIs
  • Application User Activities

• Direct Integration

  • Integration-specific application name

• Transactions

  • Transaction descriptions

• MDMs (e.g., Jamf)

  • Installed applications list on a device

• Browser Agents

  • Website URLs

• Desktop Agents

  • Application patterns

Application Matching Logic

When Zluri receives an application name/description/pattern, it attempts to match against the global app database using:

• Direct name matches in orgapp
• Exact match
• Alias exact match
• Direct match in globalapp
• Cupid mapping in orgapplication/globalapp
• Cupid mapping in global applications

Transaction/Contract applications do not get discovered.

Browser Patterns

Patterns used for browser-based application detection:

• Organization domain pattern
• Global domain pattern
• App link(s)
• Entity breakdown

Application Status

• Direct Integration → Status = Active
• SSOs → Status = Provided by SSO
• Others → Status = Active
• Manual → Status is set when application is manually added (cannot be changed)

Primary Source Priority

• First Detected Source
• Direct Integration / SDK takes priority as primary source
• Manual source = always highest

If a Direct Integration is removed, the primary source association is also removed.

Status Change Log

• Source-level changes are recorded and tracked in the status change log.

  

Application Name Normalization

Zluri processes application names from API responses and matches them with its database using fuzzy mapping logic.
During processing, special characters are removed for consistency.

Example:
If API response returns Slack #, Zluri displays it as Slack.

Special Characters Removed

\ ` ~ ! @ # $ % ^ & *( ) - _ + = | [ ] ' " : ; < > , ?