@oneuptime/common 12.0.31 → 12.0.33

package/Utils/NetworkDevice/NetworkAlertPolicyBootstrapUtil.ts

@@ -0,0 +1,247 @@
+import MonitorTemplate from "../../Models/DatabaseModels/MonitorTemplate";
+import NetworkAlertPolicy from "../../Models/DatabaseModels/NetworkAlertPolicy";
+import { CriteriaAlert } from "../../Types/Monitor/CriteriaAlert";
+import { CriteriaIncident } from "../../Types/Monitor/CriteriaIncident";
+import MonitorCriteria from "../../Types/Monitor/MonitorCriteria";
+import MonitorCriteriaInstance from "../../Types/Monitor/MonitorCriteriaInstance";
+import MonitorStep from "../../Types/Monitor/MonitorStep";
+import { MonitorStepNetworkDeviceMonitorUtil } from "../../Types/Monitor/MonitorStepNetworkDeviceMonitor";
+import MonitorSteps from "../../Types/Monitor/MonitorSteps";
+import MonitorType from "../../Types/Monitor/MonitorType";
+import NetworkDeviceAlertPackUtil from "../../Types/Monitor/SnmpMonitor/NetworkDeviceAlertPack";
+import { NetworkAlertPolicyScopeUtil } from "../../Types/NetworkDevice/NetworkAlertPolicyScope";
+import ObjectID from "../../Types/ObjectID";
+
+/*
+ * The "one click to alerting" path for network devices.
+ *
+ * An alert policy is only useful once it has a Network Device monitor
+ * template to clone, and building one by hand means walking the monitor
+ * template form: pick the type, add a step, add five criteria, fill in a
+ * severity and a status on each. Most operators want exactly the Recommended
+ * Alert Pack (NetworkDeviceAlertPack) on every device, so this util builds
+ * that template and the policy that applies it to the whole project, and the
+ * settings page find-or-creates the pair from its empty state.
+ *
+ * FIND-OR-CREATE BY MARKER. The template carries RECOMMENDED_TEMPLATE_MARKER
+ * in its description. The name is what an operator renames; the marker is
+ * what the bootstrap looks for, so clicking "create the recommended policy"
+ * twice — or after the recommended policy was deleted and its template kept
+ * — reuses the template instead of minting a second one, and instead of
+ * tripping the policy service's "another policy already uses this template"
+ * refusal on a duplicate nobody meant to make.
+ *
+ * WHY THE ITEMS ARE FILLED IN HERE. NetworkDeviceAlertPackUtil deliberately
+ * leaves severities and on-call policies for the user to complete on the
+ * monitor form. A policy's monitors are never opened in that form — the
+ * engine clones them — so a criteria whose `createIncidents` is on but whose
+ * `incidents` list is empty would clone into monitors that fire nothing.
+ * Every incident-creating item therefore gets one CriteriaIncident and every
+ * alert-creating item one CriteriaAlert, both auto-resolving, at the
+ * project's lowest-order severity (PingMonitorSeedIds resolves that).
+ *
+ * NO DEVICE ON THE TEMPLATE STEP. A Network Device step names the device it
+ * watches; a template step is a placeholder the engine rebinds per device
+ * (NetworkDeviceMonitorTemplateUtil.rebindMonitorSteps), which requires the
+ * `networkDeviceMonitor` block to exist and ignores what id it holds. The
+ * step is built with the block present and the id unset, which the
+ * template's reference validator skips rather than rejects.
+ *
+ * Pure: no database, no permissions. The caller persists both rows through
+ * ModelAPI / the services so tenancy, billing and the policy engine's hooks
+ * all run.
+ */
+
+export const RECOMMENDED_TEMPLATE_MARKER: string =
+  "[oneuptime:network-alert-pack:v1]";
+
+export const RECOMMENDED_TEMPLATE_NAME: string =
+  "Network device alert pack (recommended)";
+
+export const RECOMMENDED_POLICY_NAME: string = "Alert on every device";
+
+export interface RecommendedMonitorTemplateSeedIds {
+  projectId: ObjectID;
+  incidentSeverityId: ObjectID;
+  alertSeverityId: ObjectID;
+  onlineMonitorStatusId: ObjectID;
+  offlineMonitorStatusId: ObjectID;
+}
+
+export interface RecommendedPolicySeedIds {
+  projectId: ObjectID;
+  monitorTemplateId: ObjectID;
+}
+
+/*
+ * The slice of a MonitorTemplate the marker check reads. Kept to one
+ * optional field so a caller that listed templates with a narrow `select`
+ * can still ask.
+ */
+export interface RecommendedTemplateCandidate {
+  templateDescription?: string | undefined;
+}
+
+export default class NetworkAlertPolicyBootstrapUtil {
+  /**
+   * The template every device's monitor is cloned from: a Network Device
+   * template whose single step carries the Recommended Alert Pack, with an
+   * incident or an alert filled in on every item.
+   */
+  public static buildRecommendedMonitorTemplate(
+    data: RecommendedMonitorTemplateSeedIds,
+  ): MonitorTemplate {
+    const criteriaInstances: Array<MonitorCriteriaInstance> =
+      NetworkDeviceAlertPackUtil.buildCriteriaInstances({
+        downMonitorStatusId: data.offlineMonitorStatusId,
+      });
+
+    for (const criteriaInstance of criteriaInstances) {
+      NetworkAlertPolicyBootstrapUtil.fillCriteriaActions({
+        criteriaInstance: criteriaInstance,
+        incidentSeverityId: data.incidentSeverityId,
+        alertSeverityId: data.alertSeverityId,
+      });
+    }
+
+    const monitorCriteria: MonitorCriteria = new MonitorCriteria();
+    monitorCriteria.data = {
+      monitorCriteriaInstanceArray: criteriaInstances,
+    };
+
+    const monitorStep: MonitorStep = new MonitorStep();
+    monitorStep.data!.networkDeviceMonitor =
+      MonitorStepNetworkDeviceMonitorUtil.getDefault();
+    monitorStep.data!.monitorCriteria = monitorCriteria;
+
+    const monitorSteps: MonitorSteps = new MonitorSteps();
+    monitorSteps.data = {
+      monitorStepsInstanceArray: [monitorStep],
+      /*
+       * Where the monitor goes when no pack item matches — the device is
+       * reachable, its walk succeeds, its interfaces are up. Without this a
+       * monitor that once went Offline would never come back.
+       */
+      defaultMonitorStatusId: new ObjectID(
+        data.onlineMonitorStatusId.toString(),
+      ),
+    };
+
+    const template: MonitorTemplate = new MonitorTemplate();
+    template.projectId = new ObjectID(data.projectId.toString());
+    template.templateName = RECOMMENDED_TEMPLATE_NAME;
+    template.templateDescription =
+      NetworkAlertPolicyBootstrapUtil.buildRecommendedTemplateDescription();
+    template.monitorType = MonitorType.NetworkDevice;
+    template.monitorSteps = monitorSteps;
+    /*
+     * Left blank on purpose: a policy's monitors are named after the device
+     * alone, and a default monitor name would become a suffix on every one
+     * of them (the auto-import precedent, issue #3486).
+     */
+    template.monitorDescription =
+      "Provisioned by a Network Alert Policy. Edit the policy's template to change what this monitor alerts on; it is re-synced from the template, so edits made here are overwritten.";
+
+    return template;
+  }
+
+  /**
+   * The policy that applies the template to every device in the project.
+   * Unscoped on purpose — that is what "recommended" means here, and the
+   * settings table says "All devices" against it so nobody misreads the
+   * reach.
+   */
+  public static buildRecommendedPolicy(
+    data: RecommendedPolicySeedIds,
+  ): NetworkAlertPolicy {
+    const policy: NetworkAlertPolicy = new NetworkAlertPolicy();
+    policy.projectId = new ObjectID(data.projectId.toString());
+    policy.name = RECOMMENDED_POLICY_NAME;
+    policy.description =
+      "Every probe-polled device in the project gets a Network Device monitor cloned from the recommended alert pack: an incident when it stops answering ping and SNMP or an interface goes down, and an alert when its SNMP walk fails, an interface saturates or an interface logs errors. A device with no SNMP credentials is pinged rather than walked, so only the reachability item can fire on it until credentials are set. Narrow the scope to sites, roles or labels to cover fewer devices.";
+    policy.isEnabled = true;
+    policy.monitorTemplateId = new ObjectID(data.monitorTemplateId.toString());
+    policy.scope = NetworkAlertPolicyScopeUtil.normalize({});
+
+    return policy;
+  }
+
+  /** Whether a template is the one this util minted, by its marker. */
+  public static isRecommendedTemplate(
+    template: RecommendedTemplateCandidate | null | undefined,
+  ): boolean {
+    return (template?.templateDescription || "").includes(
+      RECOMMENDED_TEMPLATE_MARKER,
+    );
+  }
+
+  /**
+   * The recommended template among a project's templates, or null. The
+   * first marked one wins so a project that somehow holds two keeps reusing
+   * the same one rather than alternating.
+   */
+  public static findRecommendedTemplate<
+    TTemplate extends RecommendedTemplateCandidate,
+  >(templates: Array<TTemplate>): TTemplate | null {
+    for (const template of templates) {
+      if (NetworkAlertPolicyBootstrapUtil.isRecommendedTemplate(template)) {
+        return template;
+      }
+    }
+
+    return null;
+  }
+
+  /**
+   * The description the marker lives in. The marker is on its own line at
+   * the end so an operator can rewrite the prose above it without losing
+   * the tag that makes the template findable.
+   */
+  public static buildRecommendedTemplateDescription(): string {
+    return `The Recommended Alert Pack for network devices: an incident when a device stops answering ping and SNMP or an interface goes down, an alert when the SNMP walk fails, an interface runs above 80% utilization or an interface logs errors. Created by the "Create the recommended policy" action under Network > Settings > Alert Policies; edit the criteria here and every monitor the policy provisions follows. Keep the marker below so the action can find this template again.\n\n${RECOMMENDED_TEMPLATE_MARKER}`;
+  }
+
+  /*
+   * One CriteriaIncident on an incident-creating item, one CriteriaAlert on
+   * an alert-creating one, titled after the pack item so the incident an
+   * operator is paged with reads "Device unreachable", not "Criteria 1".
+   */
+  private static fillCriteriaActions(data: {
+    criteriaInstance: MonitorCriteriaInstance;
+    incidentSeverityId: ObjectID;
+    alertSeverityId: ObjectID;
+  }): void {
+    const criteriaData: MonitorCriteriaInstance["data"] =
+      data.criteriaInstance.data;
+
+    if (!criteriaData) {
+      return;
+    }
+
+    if (criteriaData.createIncidents) {
+      const incident: CriteriaIncident = {
+        id: ObjectID.generate().toString(),
+        title: criteriaData.name,
+        description: criteriaData.description,
+        incidentSeverityId: new ObjectID(data.incidentSeverityId.toString()),
+        autoResolveIncident: true,
+        onCallPolicyIds: [],
+      };
+
+      criteriaData.incidents = [incident];
+    }
+
+    if (criteriaData.createAlerts) {
+      const alert: CriteriaAlert = {
+        id: ObjectID.generate().toString(),
+        title: criteriaData.name,
+        description: criteriaData.description,
+        alertSeverityId: new ObjectID(data.alertSeverityId.toString()),
+        autoResolveAlert: true,
+        onCallPolicyIds: [],
+      };
+
+      criteriaData.alerts = [alert];
+    }
+  }
+}

package/Utils/NetworkDevice/SnmpCredentialUtil.ts

@@ -0,0 +1,68 @@
+import { SnmpVersionUtil } from "../../Types/Monitor/SnmpMonitor/SnmpVersion";
+
+/*
+ * "Does this row carry enough to open an SNMP session with?"
+ *
+ * The question is asked of three different rows in turn at poll time - the
+ * device's own snmp* columns, the profile the device points at, and the
+ * profile the device's site points at - and the first row that answers yes is
+ * the one the device is walked with. A device with no usable set anywhere is
+ * pinged and never walked. So this function is the resolution order's
+ * predicate, and it is deliberately shaped to accept ANY object carrying the
+ * three fields it reads rather than a NetworkDevice or a
+ * NetworkSnmpCredentialProfile specifically: the caller hands it whichever
+ * row it is looking at and gets the same answer for each.
+ *
+ * "Usable" is the minimum an SNMP session needs to be attempted, not a
+ * guarantee it will succeed:
+ *
+ *   - v1 / v2c: a non-empty community string. There is nothing else to send.
+ *   - v3: a non-empty security name (username). Auth and privacy keys are
+ *     legitimately absent at noAuthNoPriv, so their absence must not make a
+ *     v3 row unusable; a wrong key at a higher level is the device's error to
+ *     report, not this function's to predict.
+ *
+ * Whitespace-only values count as empty. A community string of "   " is what
+ * a form submits when an operator clears the field without the browser
+ * sending null, and it is not a credential anything will accept.
+ *
+ * The version is read through SnmpVersionUtil.parse, never compared as raw
+ * text, for the reason that module documents: the stored spelling is "V3"
+ * and the enum's is "3", and a raw comparison sends a v3 row down the v2c
+ * branch. parse() treats a missing or unrecognised version as v2c, which is
+ * also the column default on both the device and the profile - so a row with
+ * a community string and no version at all is usable, exactly as it would be
+ * polled.
+ */
+
+/*
+ * `| undefined` is spelled out on each field because the repo compiles with
+ * exactOptionalPropertyTypes: a caller building the carrier from a row it
+ * only partially selected (`{ snmpVersion: row.snmpVersion }`) hands over an
+ * explicit undefined, and that must type-check as readily as an omitted key.
+ */
+export interface SnmpCredentialCarrier {
+  snmpVersion?: string | null | undefined;
+  snmpCommunityString?: string | null | undefined;
+  snmpV3Username?: string | null | undefined;
+}
+
+export type HasUsableCredentialsFunction = (
+  carrier: SnmpCredentialCarrier,
+) => boolean;
+
+function isNonEmpty(value: string | null | undefined): boolean {
+  return typeof value === "string" && value.trim().length > 0;
+}
+
+export const hasUsableCredentials: HasUsableCredentialsFunction = (
+  carrier: SnmpCredentialCarrier,
+): boolean => {
+  if (SnmpVersionUtil.isV3(carrier.snmpVersion)) {
+    return isNonEmpty(carrier.snmpV3Username);
+  }
+
+  return isNonEmpty(carrier.snmpCommunityString);
+};
+
+export default hasUsableCredentials;

package/Utils/NetworkDiscovery/AutoImportRuleMatcher.ts

@@ -1,9 +1,8 @@
 import { DiscoveredNetworkDevice } from "../../Models/DatabaseModels/NetworkDeviceDiscoveryScan";
-import NetworkDeviceMonitoringMethod from "../../Types/NetworkDevice/NetworkDeviceMonitoringMethod";
 import ObjectID from "../../Types/ObjectID";
 import CidrMatchUtil from "../NetworkSite/CidrMatchUtil";
 import RulePatternMatchUtil from "../Rules/RulePatternMatchUtil";
-import { monitoringMethodForDiscoveredHost } from "./DiscoveryImportEligibility";
+import { isPingOnlyDiscoveredHost } from "./DiscoveryImportEligibility";
 import ScanTargetUtil from "./ScanTargetUtil";
 
 /*
@@ -134,12 +133,21 @@ export function matchesOidPattern(
 }
 
 export class AutoImportRuleMatcher {
-  // True when the host answered ping but not SNMP.
+  /*
+   * True when the host answered ping but not SNMP.
+   *
+   * Asked of the host's own SNMP answer (`isPingOnlyDiscoveredHost`), NOT of
+   * the method it would import under. Under ping-first polling EVERY
+   * discovered host imports as a Probe device, so
+   * `monitoringMethodForDiscoveredHost` is a constant — routing this gate
+   * through it made `isPingOnlyHost` permanently false and silently opened
+   * the default-closed gate below: one SNMP credential typo would have
+   * imported a whole subnet of half-identified hosts through rules that never
+   * opted in. How a host is MONITORED and what it ANSWERED are two different
+   * questions now, and this one is the second.
+   */
   private static isPingOnlyHost(host: DiscoveredNetworkDevice): boolean {
-    return (
-      monitoringMethodForDiscoveredHost(host) ===
-      NetworkDeviceMonitoringMethod.Monitor
-    );
+    return isPingOnlyDiscoveredHost(host);
   }
 
   /*

package/Utils/NetworkDiscovery/DiscoveredDeviceBuilder.ts

@@ -5,7 +5,10 @@ import ObjectID from "../../Types/ObjectID";
 import SnmpScanConfigUtil, {
   DiscoveryScanSnmpConfig,
 } from "./SnmpScanConfigUtil";
-import { monitoringMethodForDiscoveredHost } from "./DiscoveryImportEligibility";
+import {
+  isPingOnlyDiscoveredHost,
+  monitoringMethodForDiscoveredHost,
+} from "./DiscoveryImportEligibility";
 import { normalizeReverseDnsName } from "./ReverseDnsNameUtil";
 
 /*
@@ -167,7 +170,8 @@ export function buildFallbackDeviceName(host: DiscoveredNetworkDevice): string {
 }
 
 /*
- * The scan columns the builder copies onto an SNMP device. The
+ * The scan columns the builder copies onto a device: the probe onto every
+ * device, the credentials onto the ones that answered SNMP. The
  * NetworkDeviceDiscoveryScan model satisfies this structurally, so both the
  * dashboard (holding a scan model) and the rule engine (holding a scan row it
  * selected itself) can pass their scan straight in.
@@ -177,7 +181,7 @@ export function buildFallbackDeviceName(host: DiscoveredNetworkDevice): string {
  * (and are still mirrored from the list's first entry). Neither is read
  * directly here — SnmpScanConfigUtil reconciles the two — but BOTH have to be
  * SELECTED by every caller, or the credentials silently arrive undefined and
- * the device is created unable to poll. That is what
+ * the device is created as a ping-only one. That is what
  * Common/Tests/Server/Services/AutoImportScanCredentialSelect.test.ts pins.
  */
 export interface DiscoveredDeviceScanSource {
@@ -197,11 +201,18 @@ export interface DiscoveredDeviceScanSource {
 /**
  * The NetworkDevice a discovered host imports as.
  *
- * An SNMP-reachable host becomes a polled device carrying the scan's probe
- * and credentials. A ping-only host becomes a monitor-backed device with no
- * probe, no credentials and polling off: it is recorded so it can belong to a
- * site and appear on the topology map, and binding a monitor to it stays a
- * separate, deliberate step.
+ * Every host becomes a Probe device polled by the scan's probe — the probe
+ * that just proved the host answers, so the one that can keep asking. An
+ * SNMP-reachable host also carries the credential set that answered it, so
+ * its first poll walks it for interfaces, inventory and health. A ping-only
+ * host carries no credentials at all: the probe pings it and nothing more, it
+ * has a status from its first poll, and adding credentials later on its
+ * Settings page is what turns the walk on.
+ *
+ * (It used to import as a monitor-backed device with no probe and polling
+ * off, which left it on "Pending" until an operator hand-bound a Ping monitor
+ * — issue #3447. Reachability is a built-in capability of every probe-polled
+ * device now, so that dead end is gone.)
  *
  * The caller supplies the name (normally `buildDeviceName(host)`) so the
  * name-collision retry can rebuild the same device under
@@ -263,12 +274,41 @@ export function buildNetworkDeviceFromDiscoveredHost(data: {
     monitoringMethodForDiscoveredHost(host);
   device.monitoringMethod = monitoringMethod;
 
-  if (monitoringMethod === NetworkDeviceMonitoringMethod.Monitor) {
+  /*
+   * The scan's probe, on EVERY device. It is the probe that just reached this
+   * host — over ping at the very least — so it is the one that can keep
+   * polling it. Written explicitly rather than left to the column default:
+   * a Probe device with no probe is claimed by nothing and never polls, which
+   * is the "Pending forever" the whole change exists to end.
+   */
+  if (data.scan.probeId) {
+    // Re-wrapped: the scan may hold a serialized id rather than an ObjectID.
+    device.probeId = new ObjectID(data.scan.probeId.toString());
+  }
+
+  /*
+   * Polling on, for both kinds of host. The column defaults to true, but this
+   * function is the recipe both import paths share and "the probe polls this
+   * device" is the whole point of it, so the recipe says so itself rather
+   * than trusting a default that a ping-only host used to override to false.
+   */
+  device.isPollingEnabled = true;
+
+  if (isPingOnlyDiscoveredHost(host)) {
     /*
-     * A ping-only host is never SNMP-polled, so the vendor-template
-     * auto-apply (which keys off a polled sysObjectID) stays off too.
+     * A ping-only host carries NO credentials, decided BEFORE any config is
+     * looked up: `snmpConfigId` and `snmpReachable` are two fields of the
+     * same probe-written jsonb row, and nothing enforces that a ping-only row
+     * leaves the first one unset. A device that answered nothing but a ping
+     * must not import carrying a community string it rejected — it would be
+     * walked with it on every poll and read as an SNMP failure rather than
+     * as the credential-less device it is. The probe pings it and nothing
+     * more until credentials are added on its Settings page.
+     *
+     * The OID template and the vendor-template auto-apply stay off too: both
+     * key off SNMP data — a polled sysObjectID, a walked OID list — that
+     * this host did not supply and will not until it has credentials.
      */
-    device.isPollingEnabled = false;
     return device;
   }
 
@@ -280,11 +320,6 @@ export function buildNetworkDeviceFromDiscoveredHost(data: {
     device.autoApplyVendorHealthTemplate = true;
   }
 
-  if (data.scan.probeId) {
-    // Re-wrapped: the scan may hold a serialized id rather than an ObjectID.
-    device.probeId = new ObjectID(data.scan.probeId.toString());
-  }
-
   /*
    * THE credential set that answered this host, not the scan's first one.
    *

package/Utils/NetworkDiscovery/DiscoveryImportEligibility.ts

@@ -4,10 +4,19 @@ import NetworkDeviceMonitoringMethod from "../../Types/NetworkDevice/NetworkDevi
 /*
  * Pure, react-free import rule for discovery scan results.
  *
- * Every host the sweep found alive is importable; what differs is HOW. A host
- * that answered SNMP becomes a polled device with the scan's credentials. A
- * host that answered only ping becomes a monitor-backed device: no probe, no
- * credentials, health supplied later by a monitor the operator binds to it.
+ * Every host the sweep found alive is importable, and every one of them
+ * imports as a probe-polled device: the scan's probe pings it on its schedule,
+ * and walks it over SNMP as well when it has credentials. What differs between
+ * a host that answered SNMP and one that only answered ping is therefore not
+ * HOW it is monitored but WHAT rides along — the SNMP host carries the scan's
+ * credential set that answered it, the ping-only host carries none and is
+ * simply pinged until somebody adds credentials.
+ *
+ * That is a change from the SNMP-first era, when a ping-only host had to
+ * import as a monitor-backed device with no probe and polling off, and read
+ * "Pending" until an operator hand-bound a Ping monitor to it (issue #3447).
+ * Reachability is a built-in capability of every probe-polled device now, so
+ * the ping-only host gets a status from its first poll like any other.
  *
  * Ping-only hosts used to be refused outright, on the reasoning that they
  * would turn up as ARP/FDB endpoints once their switch was monitored. That is
@@ -20,33 +29,56 @@ import NetworkDeviceMonitoringMethod from "../../Types/NetworkDevice/NetworkDevi
  * because the dashboard's Review dialog and the server-side auto-import rule
  * engine both decide "how does this host import" through it, and the two must
  * never disagree: the group a host is shown under in the dialog and the
- * monitoring method a rule imports it with are the same decision.
+ * device a rule imports it as are the same decision.
  */
 
+/**
+ * True when the host answered ping but not SNMP — the "No SNMP" group in the
+ * Review dialog, and the host that imports with no credentials.
+ *
+ * Only an EXPLICIT snmpReachable === false is ping-only: scans stored before
+ * the field existed carry undefined, and every host on those scans answered
+ * SNMP (ping-only sweeps did not exist yet), so legacy rows keep importing
+ * with the scan's credentials.
+ *
+ * Nullish hosts read as NOT ping-only rather than throwing. `discoveredDevices`
+ * is jsonb written verbatim from the probe's payload and the only guard on it
+ * (DiscoveryScanOutcome.getDiscoveredHosts) checks that the VALUE is an array
+ * — never that its elements are objects. A single null element used to take
+ * the whole page down from inside a table cell or a modal body, where a thrown
+ * TypeError has nowhere useful to go. Every other kind of junk element (a
+ * number, a string, {}) already read as an SNMP host; null is simply
+ * consistent with them.
+ */
+export function isPingOnlyDiscoveredHost(
+  host: DiscoveredNetworkDevice | null | undefined,
+): boolean {
+  return host?.snmpReachable === false;
+}
+
 /**
  * Which monitoring method a discovered host should be imported under.
  *
- * Only an EXPLICIT snmpReachable === false means ping-only: scans stored
- * before the field existed carry undefined, and every host on those scans
- * answered SNMP (ping-only sweeps did not exist yet), so legacy rows keep
- * importing as SNMP devices.
+ * Probe, for every host. Under ping-first polling there is no discovered host
+ * a probe cannot monitor: the scan's probe just proved the host answers ping,
+ * and that is all a probe-polled device needs to have a status. SNMP is an
+ * enrichment layered on top when the host answered it, and
+ * `buildNetworkDeviceFromDiscoveredHost` decides that by
+ * `isPingOnlyDiscoveredHost`, not by this function.
+ *
+ * `Monitor` — a bound monitor's status IS the device's status — is an override
+ * an operator chooses on a device's Settings page for gear a probe cannot
+ * reach at all. Discovery never has grounds to choose it: every host it offers
+ * was reached by the probe that found it.
+ *
+ * Kept as a function, with the host as its argument, because it is the one
+ * seam through which the dialog and the rule engine ask the question, and a
+ * future rule that DID need to look at the host would land here.
  */
 export function monitoringMethodForDiscoveredHost(
-  host: DiscoveredNetworkDevice | null | undefined,
+  _host: DiscoveredNetworkDevice | null | undefined,
 ): NetworkDeviceMonitoringMethod {
-  /*
-   * Nullish hosts read as SNMP rather than throwing. `discoveredDevices` is
-   * jsonb written verbatim from the probe's payload and the only guard on it
-   * (DiscoveryScanOutcome.getDiscoveredHosts) checks that the VALUE is an
-   * array — never that its elements are objects. A single null element used
-   * to take the whole page down from inside a table cell or a modal body,
-   * where a thrown TypeError has nowhere useful to go. Every other kind of
-   * junk element (a number, a string, {}) already read as SNMP; null is now
-   * simply consistent with them.
-   */
-  return host?.snmpReachable === false
-    ? NetworkDeviceMonitoringMethod.Monitor
-    : NetworkDeviceMonitoringMethod.Snmp;
+  return NetworkDeviceMonitoringMethod.Probe;
 }
 
 /** True when the discovered host can be imported as a Network Device. */