A system operable to normalize configuration items associated with computing resources to facilitate network operations, the system comprising: a memory; and a processor, wherein the memory includes instructions executable by the processor to cause the system to: detect a deviation from a normal range for a hardware metric for a device; and correlate the deviation with an installation of a software on the device, wherein a configuration item is associated with the software; identify one or more partial matches between a value associated with the configuration item and a value associated with one or more computing resource types from a set of computing resource types; form a search query based on the one or more partial matches; invoke a search of one or more information sources using the search query to obtain ranked search results, wherein the one or more information sources include one or more information sources listing network security threats; select one computing resource type from the set of computing resource types based on a ranking of the search results, wherein the selected computing resource type is a computer malware; and update the configuration item to associate the configuration item with the selected computing resource type. a memory; and a processor, wherein the memory includes instructions executable by the processor to cause the system to: detect a deviation from a normal range for a hardware metric for a device; and correlate the deviation with an installation of a software on the device, detect a deviation from a normal range for a hardware metric for a device; and correlate the deviation with an installation of a software on the device, wherein a configuration item is associated with the software; identify one or more partial matches between a value associated with the configuration item and a value associated with one or more computing resource types from a set of computing resource types; form a search query based on the one or more partial matches; invoke a search of one or more information sources using the search query to obtain ranked search results, wherein the one or more information sources include one or more information sources listing network security threats; select one computing resource type from the set of computing resource types based on a ranking of the search results, wherein the selected computing resource type is a computer malware; and update the configuration item to associate the configuration item with the selected computing resource type. identify one or more partial matches between a value associated with the configuration item and a value associated with one or more computing resource types from a set of computing resource types; form a search query based on the one or more partial matches; invoke a search of one or more information sources using the search query to obtain ranked search results, wherein the one or more information sources include one or more information sources listing network security threats; select one computing resource type from the set of computing resource types based on a ranking of the search results, wherein the selected computing resource type is a computer malware; and update the configuration item to associate the configuration item with the selected computing resource type.