CMDBuild provides a configurable CMDB for managing configuration items, their attributes and relationships. Sycope analyzes network communication and provides information about systems and activity observed across the monitored environment.

Both platforms expose APIs that can be used to exchange selected information. Sycope provides an API library for integrations without dedicated templates, including NQL queries and methods for working with Lookup data. CMDBuild provides REST web services for reading and writing information stored in the CMDB.

This makes it possible to build an integration around the organization’s data model and decide which system should remain the source of truth for each type of information.

Table of Contents

From Sycope data to CMDBuild

A synchronization process can retrieve selected network or host information from Sycope and use it to create or update records in CMDBuild.

The Sycope API library allows an integration script to execute NQL queries over a defined time range and retrieve the resulting data, including larger result sets through pagination.

The selected information can then be mapped to the appropriate CMDBuild classes and attributes.

CMDBuild REST web services support operations on cards, including reading, creating and updating records. This allows information obtained from an external infrastructure or monitoring system to become part of the CMDB without requiring manual data entry.

The exact mapping depends on the CMDB model used by the organization. A network system observed in Sycope can, for example, be associated with an existing CI or used as input for creating or updating the corresponding CMDB record.

From CMDBuild context to Sycope

The integration can also work in the opposite direction.

Information maintained in CMDBuild can be retrieved through its REST API and made available in Sycope as additional context.

The Sycope API library supports creating and updating Lookups, allowing external data to be introduced into the analytical environment without becoming part of the underlying flow records.

Depending on the CMDB structure, this can include attributes describing systems, infrastructure groups or other organizational information associated with IP addresses or monitored assets.

Once available in a Sycope Lookup, CMDB information can support filtering, dashboards, searches and network investigations using terminology already maintained in the organization’s configuration database.

Complementary capabilities, clearly divided

Sycope and CMDBuild remain independent platforms and serve different roles.

Sycope provides:

Flow-based network analysis

Host-to-host communication visibility

Historical network traffic data

Network performance analysis

Network anomaly and threat detection

NQL-based search and data retrieval

Lookups for adding external context

CMDBuild provides:

Configuration item management

Flexible classes and attributes

Relationships between configuration items

Configuration history

Workflows and processes

REST-based integration with external systems

A central repository for documented infrastructure information

CMDBuild represents how the infrastructure is documented and managed. Sycope provides evidence about communication and activity actually observed in the network.

Connecting these perspectives can help teams relate the logical CMDB model to the environment operating in practice.

Connecting documented infrastructure with observed network activity

A CMDB and a network monitoring platform answer different questions.

The CMDB describes what systems should exist, how they are classified and how they relate to other components. Network telemetry shows which systems are communicating and what is actually happening between them.

Updating CMDB records with observed information

A custom synchronization process can use Sycope data as an additional source for maintaining selected CMDB attributes.

Instead of relying only on manually entered information or periodic inventory imports, organizations can use network observations when validating or updating records associated with monitored systems.

CMDBuild explicitly supports interoperability scenarios in which data managed by external infrastructure or inventory systems is automatically accepted into the CMDB through its web services.

The synchronization rules can determine which information is allowed to update CMDB records and which attributes remain under manual or another system’s control.

Adding business and asset context to network analysis

The reverse synchronization can make CMDB information available during analysis in Sycope.

A network connection between two IP addresses becomes easier to interpret when additional information identifies the systems or infrastructure groups behind those addresses.

Because CMDBuild supports configurable classes, attributes and relationships between CIs, organizations can select the context that is relevant to their network monitoring workflow.

The integration does not require the complete CMDB to be copied into Sycope. A Lookup can contain only the information needed for network analysis.

Identifying differences between documented and observed infrastructure

Combining both data sources can also support inventory verification.

A custom process can compare systems or addresses observed through Sycope with records maintained in CMDBuild.

An object present in network data but missing from the CMDB can indicate that inventory documentation requires review. A CMDB record that no longer corresponds with observed network activity may require a different type of verification.

The integration itself does not determine which system is correct. It provides the information needed to identify differences and investigate them according to the organization’s asset-management process.

Additional context during investigation

CMDB data can also help analysts understand the significance of activity observed on the network.

Information about a configuration item and its relationships can provide useful context when determining which other systems may depend on an affected component. CMDBuild is designed to model relationships between CIs specifically so that dependencies and the possible effects of failures or changes can be analyzed.

Sycope then provides the communication history associated with the systems involved.

This gives operational and security teams access to both documented dependencies and observed network relationships during an investigation.

A custom API-based integration

The public Sycope integration repository does not currently include a dedicated CMDBuild template.

Instead, Sycope provides a shared API library intended for integrations with third-party platforms that do not have dedicated templates. It includes functions for executing NQL queries, retrieving complete result sets and creating or updating Sycope Lookups.

CMDBuild is also designed for integration with external systems. Its REST services support read and write operations, and the current CMDBuild 4.2 release introduced REST API v4 with OpenAPI-based documentation.

The integration therefore needs to be configured around the specific CMDBuild data model, Sycope queries and synchronization rules required by the organization.

How the integration works

The integration can be organized around four main components.

Data selection in Sycope

An NQL query defines the Sycope information that should participate in the synchronization.

The query can select the appropriate data source, fields, filtering conditions and time range.

The Sycope API library executes the query and retrieves the results required by the integration process.

Mapping and synchronization logic

A custom integration script maps Sycope fields to the classes and attributes configured in CMDBuild.

The synchronization logic determines whether an incoming object corresponds with an existing CMDB record and whether the record should be created, updated or left unchanged.

These rules should reflect which platform is considered authoritative for each field.

CMDBuild REST API

The integration communicates with CMDBuild through its REST web services.

CMDBuild APIs allow external applications to read and write CMDB data and perform operations on individual cards.

The implementation should use the API version available in the deployed CMDBuild environment. CMDBuild 4.2 introduced REST API v4 and OpenAPI documentation for current integrations.

Optional CMDB context in Sycope

If information should also flow from CMDBuild to Sycope, the synchronization process can retrieve selected CMDB records and prepare them as a Sycope Lookup.

The Sycope API supports creating new Lookups and updating existing ones through the integration library.

This provides a controlled way to make selected CMDB attributes available during network analysis without replicating the complete configuration database.

From network observation to CMDB context

Consider a server that appears in network communication analyzed by Sycope.

The synchronization process retrieves the selected information through an NQL query and checks whether the corresponding CI already exists in CMDBuild.

If the record exists, configured attributes can be updated according to the synchronization policy. If it does not, the integration can provide the information required to create a new card or flag the object for further processing.

In the opposite direction, selected information about the same CI can be retrieved from CMDBuild and stored in a Sycope Lookup.

When the server later appears in a performance or security investigation, the analyst can work with its network communication together with the additional infrastructure context maintained in the CMDB.

The integration connects the documented configuration with network activity while allowing each platform to remain responsible for its own data and workflows.