InsightVM Dynamic Asset Groups Filtered by RegEx

InsightVM
1

Hey,

as the filtering rules in IVM are restricted to use AND or OR exclusively but in general IVM supports regex: Is it possible to use regex for searching with like operator in the following way: ^(PARTIALHOSTNAME1|PARTIALHOSTNAME2)$ that allows me to filter for assets containing either one of those both substrings? I know that you can filter for both via separate filter using ANY/OR. But if you do so you can’t set an ALL/AND filter (e.g. for the operating system).

2

I’ve never found a good way to do this, and have asked R7 about this a few times. I have seen a recent comment that suggest this may be improved so who knows but, in the meantime, the ‘bad’ way to do this is use tags. It’s bad because you end up with hundreds of tags that solely exist to get around this problem and it easily gets out of hand.
As an example:

  1. Create a tag with a tagging rule set to show where hostname contains ‘ABCD’ OR hostname contains ‘EFGH’.
  2. Create your dynamic asset group looking for the tag created above AND where OS contains ‘Windows 11’

This way you’re only then using a single AND\OR in each step. From experience, don’t just rush into this - plan the tags and naming convention before you start!!