CMDB is the system of record for everything your clients own and everything your team needs to support it. Assets, config items, passwords, network ranges, knowledge base articles, licenses, warranties, contracts and attachments all live in one client-scoped place in the Hub. When a ticket lands at 2 a.m., CMDB is how a technician answers "what is this, who owns it, what does it connect to, and how do we fix it" in one screen.
Where to find CMDB in the Hub
- Open CMDB from My Apps, or go to app.theonestack.com/cmdb.
- If you've worked in CMDB before,
/cmdbtakes you straight back to the last client you had open. - Otherwise you land on Pick a Client (
/cmdb/clients). Choose a client and every page is scoped to it; the address becomes/cmdb/c/<client>/…. - Use Switch Client in the Overview group of the sidebar to change clients.
Client scoping is deliberate. One client's records can never show up on another client's pages. See Select a client in CMDB.
What lives where
With a client selected, the sidebar is grouped like this:
| Sidebar group | What you'll use it for | Guide |
|---|---|---|
| Overview | The client dashboard, including upcoming license, warranty and contract expirations, plus Switch Client | Select a client |
| Asset Management | Config Items, Flexible Assets, Licenses, Warranties, Contracts | Add config items and flexible assets · Licenses, warranties and contracts |
| Documentation | Knowledge Base articles and documents, linked to the config items they cover | CMDB user guide |
| Network | Network/IPAM (subnets, VLANs, address lists), Relationships, and the full-screen Topology Map | Scan networks and review discovery · Topology and impact |
| Security | Password Vault and Discovery | Password vault · Discovery |
| Education | K-12 Chromebook fleets: Google Sync, repairs, RMAs, device sets | Education and Chromebooks |
The sidebar also has Device Lifecycle, Management and Intelligence groups.
What CMDB gives you
- Asset inventory and config items. Every physical and virtual asset, with manufacturer, model, serial, IP, MAC, OS, location, assignment, purchase date and warranty. Config items add relationships, criticality, environment and business owner.
- Flexible assets. Your own record types, such as line-of-business apps, vendor accounts and SSL certificates, with the fields you choose.
- Password vault. AES-256-GCM encrypted credentials with check-out and check-in, rotation, breach checking against Have I Been Pwned, and a per-password audit history.
- Relationships, topology and impact analysis. See how a client's systems depend on each other, and who's affected before you touch anything.
- Network IPAM and discovery. Subnets with on-demand and scheduled scans, plus discovery results from RMM that you match to existing CIs or turn into new ones.
- Licenses, warranties and contracts. Seat use and renewal dates with expiry warnings, so nothing lapses or auto-renews without anyone noticing.
- Knowledge base. Wiki and KB articles you can search from any page, each visible to Internal, MSP-wide or Client Portal audiences.
- Change requests. Propose a change to a CI, review the diff, then approve or reject it.
- Attachments, QR labels and full-text search across assets, configurations, wiki and KB.
- Audit log. Every view, edit, delete and check-out is recorded.
How CMDB connects to the rest of The One Stack
- RMM. Devices that RMM discovers show up in CMDB Discovery for matching. From an RMM remote terminal, Inject Credential types a vault password into the session, and the staged credential expires after 60 seconds. Executable runbooks live in RMM → Runbooks; CMDB holds the reference docs linked to each CI.
- HCP (Hub Client Portal). Only the passwords, wiki pages and warranty views you choose to share reach your clients' staff. School staff see their own Chromebook fleet in HCP, not in CMDB. See Chromebook management (K-12 schools).
- THEO. THEO never reveals a CMDB password. Vault contents are always blocked from it.
- Browser extension. Copy a saved password into a login form in one click.
Good to know
- Your client can't see passwords unless you share them through the portal share option. By default the vault is for MSP staff only.
- Passwords are never added to the search index.
- New items show up in search on the next indexer run, which happens every five minutes.