Hiya. In our InsightVM / Nexpose console we have a site with an AWS discovery connection. Assets are being created properly, however we see duplicates created over time.
The correct asset record has the internal DNS name of the instance and scan data, but no meta-data. The duplicate record has only the ec2 metadata but no scan data, no details (e.g. MAC address) and no DNS name, only the IP and ec2 default name (e.g. ip-xx-xx-xx-xx.ec2.internal)
Support so far has been unable to solve this. Our DNS resolvers are consistent across all scan engines and the console.
Has anyone else run into this and maybe resolved it?
I checked with the team on this and we’ve actually identified the duplicate AWS assets issue as a known issue within the product. We’ve got a ticket in for it and are planning to implement a fix in the coming months.
I double checked and the team is actively working on a fix for this. My understanding is that the best way around this for now is to ensure you’re running authenticated scans. This will resolve the AWS/agent unique ID’s and allow for correlation. If that’s not possible, then the fix we’re working on can further help.
Is your problem showing multiple assets all with the same Unique Identifier from the agent on the AWS instances but all with different vulns? That’s what we’re experiencing in our environment. It sounds related but similar, I wanted to verify.
Hi,
it isn’t the same problem but your problem seem to be Asset correlation issue.
you must set asset correlation on and configure your scan template to Allows the Insight Agent to respond to the Rapid7 Scan Engine on UDP Port 31400 with the asset UUID to ensure proper asset correlation.
I checked out settings and asset correlation is ON on the agents, and our template is using common ports and it’s also specifically got 34100 listed in the additional UDP ports section. Still getting multiple asset copies like I mentioned. Any other ideas?
@geoff_galitz, here is a simple SQL query my team and I came up with to assist us with duplicates. We have this scheduled to run as a daily report. You still have to find search out the asset and remove the oldest one, however it works pretty well regardless. We run this against our “Rapid 7 Agent” Site, but you can run it against any/all sites if you wish. Hope this helps!
SELECT DISTINCT UPPER(da.host_name) AS Host_Name, count(*) AS Duplicates
FROM dim_asset da
GROUP BY da.host_name
HAVING count(*) > 1