Timing Intervals

This section provides guidance around timings for agent check-in and engine scan frequencies, during which time the components will communicate back to the Neurons Platform based on the outlined schedule. Use the timing intervals to get an idea of what runs when, so you can gauge whether the data in the Neurons Platform UI is up to date.

• Inventory Scan: 2 hours. Repetition interval of 2 hours, of which the exact start time is randomized within each interval. Every time the scan runs it determines (using its own internal schedule) if it should actually be run. If the internal schedule is not met, it will exit without scanning. The inventory internal schedule is 3 days +1-4 days. Therefore, a scan should happen anywhere from 4 to 7 days. The inventory scan will transfer the complete set of data for the one device every interval (4-7 days) which is approx. 4-7mb.
  • Inventory Scan - Linux & Mac: 4 days. Repetition interval of 3 days, of which the exact start is randomized within each interval.

• Agent Check-in: 200 minutes. Repetition interval of 200 minutes, of which the exact start is randomized within each interval. Small amount of data sent per device to identify the device and contain a JWT token.

• Discovery Scan: Data sent per device discovered approx. 1kb/device.
  • Network range scans: Scanned on schedule configured by user.
  • Passive scans: Listens to the network all of the time, uploads within approx 5 mins of hearing about a device.
  • Global Discovery scans: If enabled, scans devices shown in Discovered Devices page that are not included in a configured range. Each device rescanned 24 hours after it was last scanned. Results uploaded immediately after each scan.

• Patch & Binary Updates: 1 hour. Repetition interval of 1 hour, of which the exact start is randomized within each interval.

Normalization

Normalization is the process by which data is standardized across data sources. For example, say you have three different sources that all provide the manufacturer for a particular device. Source A says that it’s “Dell”, source B says that it’s “Dell Inc.”, and source C says that it’s “Dell Technologies”. When you bring that data together in a single source, you need to choose which value is going to be used. In this example, the correct legal term is “Dell Inc.”. However, most people commonly refer to it as “Dell” so that’s the value that would most likely be used. 

Ivanti Neurons has a normalization engine to handle cases like this to clean up the data it discovers, inventories, and imports so it can be used in many other systems. Ivanti Neurons never overwrites any of the original data and stores each source separately. That way if the normalization rules are updated, they can be applied again to the data.