I create a connection to a vSphere machine. When I tried more than one filter, no resources were discovered. IF I only had one filter to a single cluster, resources were found.
Found this: What is the difference between “all” and “any”. i see options like “is” and “contains” Is that what the docs mean by these options?
https://docs.rapid7.com/insightvm/using-filters-to-refine-dynamic-discovery
" Combining discovery filters "
If you use multiple filters, you can have the application discover assets that match all the criteria specified in the filters, or assets that match any of the criteria specified in the filters.
The difference between these options is that the all setting only returns assets that match the discovery criteria in all of the filters, whereas the any setting returns assets that match any given filter. For this reason, a search with all selected typically returns fewer results than any.
If I put the following filters for example
- DataCenter = Detroit
- Cluster contains = ABC
- Cluster contains = XYZ
When I have #1, #2 results are narrowed to machines in cluster ABC. When I try to add other Clusters like #3, no results so the narrowing of assets across multiple clusters appears to be limiting requiring me to create multiple sites. Each site would contain a single cluster to help keep results narrow.
I like the dynamic discovery option vs. static IP ranges is that helps be efficient.
Ok…so…Yes…I am new at Rapid7…So it looks like this.
- have a site that does nothing but a discovery scan…put all networks I want scanned
- create Asset Groups based on criteria found in discovery scan to help “filter”
- create new site and add the “said” Asset groups created in step #2.
We’ll see how this works out! i found the “all” and “any” in the Asset groups section.