PassiveNetworkDependency
Passive Network Dependency Discovery Module
What it does
Builds an application dependency map by passively analyzing network flow data already collected by upstream discovery (NetworkDiscovery.psm1, NetworkScanDiscovery.csv, NetFlow/sFlow exports, or firewall logs). Unlike ApplicationDependencyDiscovery which uses live Get-NetTCPConnection on the local host, this module operates on pre-collected flow records, enabling enterprise-wide visibility without agents. Competitive parity target: RISC Networks, Flexera IT Visibility. Input sources (auto-detected, first match wins): 1. NetworkFlow.csv (preferred: SourceIP,DestIP,DestPort,Protocol,Bytes,Packets,FirstSeen,LastSeen) 2. NetworkDiscovery.csv (host inventory with role hints) 3. NetworkScanDiscovery.csv (nmap port-scan results) 4. FirewallLogs.csv (5-tuple flow logs) Output: PassiveNetworkDependencyDiscovery.csv with columns: SourceHost, SourceTier, DestHost, DestPort, DestService, Protocol, FlowCount, BytesTotal, FirstSeen, LastSeen, DependencyType, ConfidenceScore
How the app exposes it
The module runs through the ACQI discovery orchestrator and writes its rows into a dedicated results view. From there, conflicts, dependencies, and readiness scores feed the deal-wide consolidation layer.
/discovered/passive-network-dependency Outputs
Each module emits a normalised CSV keyed by entity ID with readiness and risk scores, evidence-source counts, and last-seen timestamps. The exact column set varies by module — the app's results view shows the live schema.