Exclude assets - wildcards in IP ranges

InsightVM
1

We’re trying to clean up the Sites in our environment, particularly the excluded assets. Is there a way to include wildcards in IP ranges? Here’s an example:

Our networking department uses .1 and .2 for equipment that we want excluded from certain sites. What I would like to do is exclude 10.x.x.1 - 10.x.x.2 (or even 10.10.x.1 - 10.10.x.2). While the input for asset exclusions accepts that format, the assets are still scanned and discovered. Is this possible? If not, does anyone have a similar situation, and how are you handling it? Just importing a text file with that exclusion for every subnet?

Thanks for your input!

2

If these systems are still scanned in some sites, then you could create a dynamic asset group with a filter that would only include the .1 and .2.
It would probably be a like operator on the IP field. This operator supports regex.
Then you could add this group as an excluded asset group to certain sites.

1 Like
3

Interesting! I had no idea those operators supported regex. I did some testing and built an expression that can filter those IPs out. I’ll tinker a little more and see what I can come up with. Thanks!

1 Like
4

I’m curious…any luck?
(Default gateways and other switch interfaces not rolling up to the single switch asset drives me crazy)

5

That’s exactly the issue we’re trying to remedy (one of them, anyway). It seems to be a viable solution so far, but I’m still working with our networking department to determine what IPs/ranges can safely be filtered out. The only downside to the approach I can see is that it will still affect your total asset count (and thus, your license). In short, here’s the setup:

  • Discovery site set to scan our entire IP range, discovery only
  • All other sites are populated using dynamic asset groups
  • Dynamic asset groups using the “IP Address”, “like” or “not like” with the following regex as a base:
    \^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\$

I’m avoiding using anything to dynamic asset groups to populate sites wherever possible, and also making use of global exclusions.