Duplicate Assets via Scan Assistant

InsightVM
1

I noticed duplicate assets occurring in InsightVM from network scans that use Scan Assistant. The issue is when a system is reimaged / rebuilt with the same hostname and IP, R7 adds it as a duplicate asset with a new unique identifier. Moreover, all the custom tags are not assigned to the newly duplicated asset.

This is negatively impacting Remediation Projects and other areas where the tag is being used.

I requested these two IDEA / feature requests:

  1. If a duplicate asset is discovered with same IP and hostname and with a different unique identifier, then rename or mark the old asset unique identifier as stale or give custom option to bulk delete them.

  2. If a duplicate asset is discovered with same IP and hostname and with a different unique identifier, and custom tags are attached to old unique identifier, then copy over the custom tags to the new active asset.

2 Likes
2

All new Assets even when rebuilt, will have a new WINDOWS/UNIX identifier. When R7 sees that as a new HOST its going to create a new Asset ID.

if you have Static TAGS, they will not apply

but im assuming you know all this hence the idea.

1 Like
3

Do you have the agent deployed in your environment? I scripted out a rough solution to this for instances where there are re-imaged assets that make use of a freshly installed agent. If so I would be happy to share via github or collaborate to improve it.

1 Like
4

@mcarns,
We use the Insight Agent on Laptops, the Scan Assistant on servers and VM’s, and shared creds for infrastructure assets. I am very interested in your script :slight_smile:

5

Let me pull any sensitive information out of it. Do you have specific reasoning for not deploying the agent to all workstations, laptops, and servers?

1 Like
6

Yes, here are our reasons:

  1. Overall agent bloat.
  2. No need for multiple daily vuln. scans from servers with our patching cycle.
  3. Previous issues with the Insight agent on vDI/ephemeral VM’s
7

A rebuilt asset will create a new asset record on purpose, that’s the design intent. It’s not really a duplicate at that point. If the goal is to avoid extra vulnerabilities based on two instances of the same machine existing, I’d have to recommend just deleting the old record. Manually if it’s a rare situation, through lower asset data retention if it’s extremely common, or through api scripting if it’s somewhere in the middle.