---
updatedAt: 2026-09-03T12:00:05.000Z
agentTools:
  projectIndex: https://help.zluri.com/llms.txt
---

# Application Discovery

Application discovery in Zluri identifies applications used across the organization by processing data from multiple sources. Discovered applications are added to the application inventory based on predefined source logic and matching rules.

## Discovery Sources

Zluri discovers applications from the following sources:

* **Single Sign-On (SSO) providers**

  Examples include Azure AD, Google Workspace, Okta, OneLogin, and JumpCloud.

* **Direct Integrations**

* **Manual additions**

* **Transactions**

* **Agents**

* **Mobile Device Management (MDM) systems**

* **CASB tools**

* **Plugins**

Each source contributes application identifiers based on the type of data it provides.

## Folders Used for Discovery

Zluri processes data from the following folders to detect applications:

* **List of Applications** (from SSO providers)
* **Application Users**
* **Activity**
* **Transactions**

  Disabled by default. Can be enabled if required.

## Discovery Behavior by Source

Application discovery differs based on the source:

### SSOs

* Application list
* Application user APIs
* Application user activity data

### Direct Integrations

* Integration-specific application names

### Transactions

* Transaction descriptions

### MDMs

* Installed application lists on managed devices

### Browser Agents

* Website URLs

### Desktop Agents

* Application usage patterns

## Application Matching Logic

When Zluri receives an application name, description, or pattern, it attempts to match the application against the global application database using the following logic:

* Direct name match in `orgapp`
* Exact match
* Alias exact match
* Direct match in `globalapp`
* Cupid mapping in `orgapplication/globalapp`
* Cupid mapping in global applications

Applications discovered from **transactions or contracts are not added** to the application inventory.

## Browser-Based Detection Patterns

For browser-based discovery, Zluri uses the following patterns:

* Organization domain pattern
* Global domain pattern
* Application links
* Entity-level breakdown

## Application Status Assignment

Application status is assigned based on the discovery source:

* **Direct Integration**

  Status is set to *Active*

* **SSOs**

  Status is set to *Provided by SSO*

* **Other sources**

  Status is set to *Active*

* **Manual additions**

  Status is set during manual addition and cannot be changed

## Primary Source Priority

Each discovered application is associated with a primary source.

Priority rules:

* The **first detected source** becomes the primary source
* **Direct Integration or SDK** takes priority over other sources
* **Manual source** always has the highest priority

If a direct integration is removed, the primary source association is also removed.

## Status Change Log

Zluri records source-level changes in the status change log.

This log tracks changes related to application discovery and source updates.

## Application Name Normalization

Zluri normalizes application names received from APIs before matching them against the database.

Normalization behavior:

* Uses fuzzy matching logic
* Removes special characters for consistency

**Example:**

`Slack #` is normalized and displayed as `Slack`.

### Removed Characters

The following special characters are removed during normalization:

```
\ ` ~ ! @# $ % ^ & * ( ) - _ + = | [ ] { } ' " : ; < > , ?

```

***