Automated Actions DHCP

InsightVM
#1

When configuring an asset centric automated action I have two options:

  • Known Asset Available
  • New Asset Discovered

I have thought that New Asset Discovered would only pick out devices that have not been scanned before, but it seems that is not the case as I have several devices continuously showing up in these automated scans.

Have I misunderstood the difference between these two options maybe? What is the actual difference between them? How does the console choose if it is a new or a known device?

What I would want to achieve is to have two automated action scan scopes:

Scope 1 - Known devices that we previously have seen and scanned, these devices I want to scan for example if they have not been scanned in the last 96h.

Scope 2 - New devices that we have not seen before, these devices should be scanned no matter what so that we know what we are dealing with.

#2

My understanding is that “New asset discovered” is referring to newly discovered, unscanned devices. What kind of action are you taking for these new assets? If the new asset is added to a site and then you’re doing a scan, I’m wondering if that automated action is including all assets in that site for the scan.

#3

That was my thought as well.
When we discover a “New asset” we do a full scan of that one with the option scan in site and then I would assume that this device should no longer be counted as a new asset but rather a known device.

However sometimes I can see that same device showing up the very next day in the “New asset” scans - which doesn’t make sense for me. So that is why I wondered what would be the expected behaviour in this case :slight_smile:

Running the scan of the device as scan in site is not including the rest of the assets in that site - only the one that it have discovered just now.

#4

Interesting… So you have a new asset, it gets scanned, and then you sometimes see it showing up the very next day in another “new asset” scan. Is it consistently following that pattern (the “next day” pattern, I’ll call it), or are you seeing already-discovered assets from even further back showing up in these new asset scans? I’m mostly trying to see if there’s any consistency here, or if it seems to be happening with any assets regardless of things like site or when they were discovered.

#5

I found some device that showed up several days which was why I noticed it in the first place, but I’ll see if I can manage to find some more patterns on the devices that gets “re-discovered” like this.
But from my initial findings this is not happening to all devices so just a few of them seems to show this behavior. Going to see if there might be any patterns in that as well and report back.

1 Like