iConfig: Fast Documentation for Readers

User Guide

What it is: iConfig discovers and synchronizes the hardware and software inventory of your endpoints (laptops, desktops, servers) directly into Jira Service Management → Assets, using lightweight agents based on osquery.
What it is NOT: it is not a network scanner (network discovery) or an MDM. It collects data only from devices where the agent is installed.

Overview

The agent (osquery) collects inventory on the endpoint and sends it to the iConfig backend.
The backend processes it, applies software filters, and prepares an import.
The iConfig app in Jira synchronizes this data to your Assets schema — automatically every 1 hour, or manually using the Sync Now button.

https://idevsolucoes.atlassian.net/wiki/spaces/ICONFIG/whiteboard/2656763906?atl_f=PAGETREE

Requirements

Supported platforms (agent)

OS	Versions

OS	Versions
Windows	10, 11, Server 2019+
Linux	distributions with `dpkg` (Debian/Ubuntu) or `rpm` (RHEL/Fedora/SUSE)
macOS	versions with supported osquery

Jira

Jira Service Management with Assets enabled.
The person performing the setup must be an Assets Administrator (Assets Manager role in the schema). Being only a Jira admin is not enough.

Network and security

Common question: "Do I need to open any inbound ports?" Answer: No. The agent is 100% outbound.

Direction	Port	Destination	Required

Direction	Port	Destination	Required
Outbound	TCP 443 (HTTPS)	`iassets.io`	✅ Yes
Outbound	53 (DNS)	your DNS resolver	✅ Yes
Inbound	—	—	❌ None

The agent initiates all connections. The server never opens a connection back to the endpoint.
All communication uses HTTPS/TLS on port 443.
It works behind NAT, corporate proxy, and firewall like any HTTPS client.
There is no port configuration to perform — the installer already includes everything the agent needs to connect to your instance tenant and establish the secure connection.
Allowlisting is only needed if outbound port 443 is blocked to the iassets.io destination on the device/network. In that case, allowlist by FQDN (iassets.io) — recommended in Zero Trust / SASE environments.

Installation (step by step)

The app opens a 3-step onboarding wizard.

Step 1 — Connect

iConfig automatically registers your Jira site in the backend. You do not need to do anything other than wait for confirmation.

Step 2 — Setup Assets

Defines which Assets schema the objects will be created in.

Click Open Assets Schema ↗ (opens directly in the Import tab).
Click Create Import → select iConfig Hardware Inventory.
Click Import data.
Return to iConfig and click Done →.

iConfig can create the schema automatically ("iConfig Hardware Inventory") or use an existing schema you already have.

Step 3 — Install Agent

Download Agent tab.
Choose the platform (Windows / Linux / macOS).
Download Installer.
Distribute and install it on the endpoints (see below).

Windows

Downloads an MSI (iconfig-agent.msi), distributable via GPO / Intune / SCCM.
Installs silently in C:\Program Files\iConfig\.
Registers a Scheduled Task as SYSTEM.
The MSI already embeds osquery — no additional internet access is required on the endpoint during installation.
Performs the first check-in immediately after installation.

Linux

Bash script that installs osqueryd as a systemd service (iconfig-osqueryd.service).
Configs in /etc/iconfig/, logs in /var/log/iconfig/.

macOS

Bash script that registers a LaunchDaemon (com.iconfig.osqueryd).
Logs in /var/log/iconfig/osqueryd.log.

Synchronization (Sync)

Automatic: every 1 hour, iConfig synchronizes the inventory to Assets.
Manual: Sync Now button on the Dashboard (Assets admin only).

Roadmap: configurable scheduling (choosing the frequency) is planned. Today the interval is fixed at 1h — we are measuring the impact on Forge before releasing customizable scheduling.

Force collection now (for testing):

Restart the agent on the endpoint:
- Linux: sudo systemctl restart iconfig-osqueryd
- macOS: sudo launchctl unload/load /Library/LaunchDaemons/com.iconfig.osqueryd.plist
- Windows: Restart-Service osqueryd
Wait ~1 minute.
Click Sync Now on the Dashboard.

What is collected

The "iConfig Hardware Inventory" schema creates the following object types in Assets:

Object Type	Content

Object Type	Content
Host	Name, Hostname, FQDN, Serial Number, UUID, Vendor, Model, RAM, Uptime, Timezone, Last User, Last Seen, First Seen, Check-in Count
Operating System	OS shared across hosts
OS Version	OS version
CPU	processor
Network Interface	network interfaces (per host)
Software	installed software (unique name + version)
Installed Software	host ↔ software relationship (N cardinality)
File System	file systems (per host)
Users	local users

Endpoint collection frequency (osquery):

Hardware / OS / network: every 1 hour
Software packages: every 2 hours

Software Filters (Rules)

Why it exists: an endpoint's software list is usually very "noisy" — full of updates, runtimes, hotfixes, etc. Without a filter, each of these would become an object in Assets, unnecessarily consuming objects.

With Software Filters, you control what enters Assets. It works in two ways:

Reduce noise: filter common/repetitive items (e.g., Windows update "KB" entries) so they do not consume objects.
Whitelist: filter everything that is allowed — and the rest populates Assets, becoming the basis for monitoring rules (unauthorized software, for example).

Rule types

Field	Options

Field	Options
Platform	All platforms · Windows · Linux · macOS
Match type	Starts with (prefix) · Exact name · Contains · Ends with (suffix) · Regex
Value	the text/pattern to match

Rules are grouped by platform in the interface. You can enable/disable each rule individually.

Power Query (live query)

The Power Query tab lets you run a live osquery query on a specific endpoint, with results in seconds. Useful for targeted investigation.

Important: the result is view-only — it does not update Assets.

Examples:

-- Windows: installed programs
SELECT name, version FROM programs;

-- Linux (Debian/Ubuntu)
SELECT name, version, arch FROM deb_packages;

-- Linux (RHEL/Fedora)
SELECT name, version, arch FROM rpm_packages;

-- macOS
SELECT name, bundle_short_version AS version FROM apps;

Permissions (who can do what)

Action	Who can

Action	Who can
View Dashboard, Software Filters, Power Query, Settings, Download Agent	Assets Admin (Assets Manager role in the schema)
Sync Now / Reset import	Assets Admin
Complete onboarding	Assets Admin

Why isn't being a Jira admin enough? A Jira administrator who does not have a role in Assets cannot manage schemas — that is why iConfig specifically requires the Assets Manager role. If you are a Jira admin but see "Assets Administrator access required", ask an Assets admin to grant the role.

Frequently asked questions (FAQ)

Do I need to open any inbound ports / inbound firewall rules? No. The agent is 100% outbound and only uses outbound HTTPS 443 to iassets.io. Inbound: nothing.

Is the update manual or can it be scheduled? Today the sync runs automatically every 1 hour. Configurable scheduling is on the roadmap (we are measuring the impact on Forge before releasing it). Sync Now lets you force it manually at any time.

Can I have the license expiration date for software on a machine? Today, it can be mapped manually as an attribute. For the next version, a way to retrieve the last license usage on that machine is planned (via query). Follow the roadmap.

Does iConfig pull corporate smartphones connected to the office network? Not in the way a network discovery tool would. iConfig collects only from devices where the agent is installed. Smartphone support is under evaluation, but it is not finalized yet. iConfig was not designed to be a network discovery tool or an MDM.

Does it work behind a corporate proxy? Yes — it is standard HTTPS traffic. If TLS inspection is in place, ensure the iassets.io certificate is trusted or bypass SNI for this destination.

How many objects will this create in Assets? It depends on the number of hosts and software items. Use Software Filters to control the volume of software objects (the biggest source of noise).

Troubleshooting

Symptom	Check

Symptom	Check
Endpoint does not appear on the Dashboard	Agent installed? Outbound port 443 allowed to `iassets.io`? Check the agent logs
Software does not update	Package collection runs every 2h; force it by restarting the agent + Sync Now
"Assets Administrator access required"	You need the Assets Manager role in the schema, not just Jira admin
Alerts do not create issues	Configure the Project Key in Settings
Sync fails	Check the toast message; 503 = backend temporarily unavailable, 429 = rate limit

Agent logs:

# Linux
journalctl -u iconfig-osqueryd -f

# macOS
tail -f /var/log/iconfig/osqueryd.log

# Windows
Get-Content "C:\Program Files\iConfig\osqueryd.results.log" -Wait

Privacy and data

iConfig collects hardware and software inventory (hostname, IP, OS, installed software, users, serial number) and processes it in iassets.io to generate the import in Assets. See the Privacy Policy and DPA in the Marketplace listing for details about data processing.