Deduplication of Unmanaged Assets

An asset in the Qualys platform is considered managed if it is reported to the Qualys platform either by active scanning or when the Qualys Agent installed on the asset reports it. When CAPS functionality is activated on the Cloud Agents, it passively identifies assets in the neighborhood and deduplicates assets identified with managed assets. Such deduplicated assets are displayed in the managed inventory.

Deduplication with managed assets uses basic asset identity parameters such as the MAC address and hostname.

• CAPS always reports assets with MAC addresses. If MAC is reported for the managed asset, then CAPS deduplicates the unmanaged asset that it identified with the managed asset using MAC.
• If a hostname but no MAC is discovered for the managed asset and the hostname is identified by CAPS, then CAPS deduplicates the asset that it identified, with managed using the hostname.

 IP-based deduplication is currently not implemented in CAPS.

Use Case 1:  Assets Reported with same Hostnames

CAPS triggers the deduplication only when it receives an update from the CAPS-activated agent that reports the asset. This means that CAPS evaluates the deduplication logic for merging the unmanaged asset it detected with the managed asset only when CAPS binary reports the asset update.

For example, A CAPS unmanaged asset is created at time T1 with hostname H1, and a managed asset is created at time T2 with hostname H1. As deduplication is not triggered yet, the managed asset is shown in the managed inventory with hostname H1, and the CAPS reported asset is shown in the unmanaged inventory with the same hostname H1.

At a later time say T3, CAPS reports the same asset again, it deduplicates the managed and unmanaged assets with matching hostnames H1 and the asset is shown only in the managed inventory.

Use Case 2: Unmanaged Asset Reported with FQDN

When CAPS reports a managed asset with its hostname and FQDN, but without a MAC address, and an unmanaged asset with hostname, MAC address, and FQDN, the deduplication is based on FQDN. In this case, CAPS creates the FQDN for unmanaged assets with its hostname appended by the domain name. 

When the domain name for an unmanaged asset is not available, the domain name of the reporting CAPS leader is used to create the FQDN for unmanaged assets.

For example, consider the following assets reported by CAPS:

• Asset A1: A managed asset reported with FQDN H1.example1.com no MAC address
• Asset A2: An unmanaged asset A2 with with hostname H1, MAC address M1, and domain name example.com

In this case, CAPS attempts to deduplicate the unmanaged asset based on the FQDN of the corresponding managed asset A1.

Similarly, when the following assets are reported,

• Asset A1: A managed asset reported with FQDN H1.example.com and no MAC Address
• Asset A2: An unmanaged asset A2 with with hostname H1, MAC address M1, and no domain name

In this case, CAPS assigns the domain name of the reporting CAPS leader to the unmanaged asset and creates an FQDN for it, such as H1.example.com. CAPS then uses this FQDN to compare with the FQDN of the managed asset and deduplicate it.