The disclosed technology is generally directed to the identification of unobservable nodes. In one example of the technology, a set of monitored machines are monitored. Each of the monitored machines includes associated monitoring logic. Monitoring the set of monitored machines includes receiving the machine information from the monitoring logic. A total inventory list of the set of monitored machines is generated in a manner that is independent of the monitoring of the monitored machines. An agent inventory list is generated such that the agent inventory list is a list of machines that, based on the monitoring of the monitored machine, are determined to have been running monitoring logic during a particular time period. Unobservable machine information that is associated with a set of unobservable machines is determined based on a comparison of the total inventory list with the agent inventory list.