About Merging Duplicate Assets
When a Qualys sensor and a third-party source both report the same host, your inventory can hold two records for one machine. Merging turns those records into one managed asset. ETM merges records through the reconciliation rule.
Navigate to: Inventory > Rules > Reconciliation
Use this to
- Understand what merging does to duplicate records.
- Decide when to merge duplicate assets.
- Choose whether merging runs on a schedule or only when you start it.
What Merging Does
The reconciliation rule merges assets that Qualys sensors, such as the Qualys agent or scanner, discover with assets that third-party sources have already identified. The duplicate records become a single managed asset.
REVIEWMerging is one of three steps that keep your inventory free of duplicates:
- Identify: asset identification rules decide which records count as the same asset.
- Merge: the reconciliation rule combines the matching records.
- Purge: purge rules remove records that no source reports any more.
The reconciliation rule merges only the records your identification rules match. So check your identification rules before you merge.
When to Merge
Merge records when a third-party source has already identified an asset, and a Qualys sensor then discovers the same host again on a different schedule.
Example: During asset sync or discovery, two different scans find the same IP address. An IP scan and a ServiceNow scan each identify an asset with that IP address, and the ServiceNow scan found its asset first. Without merging, your inventory holds two records for one host. When you run the reconciliation rule, the two records become a single managed asset.
If the same host appears more than once in your inventory after you connect a third-party source, merge the records, and then check the asset list again.
When Merging Runs
You choose how the reconciliation rule runs:
| Option | How it runs | Type column shows |
|---|---|---|
| Recurring | The first merge runs 5 minutes after you configure the rule. After that, the rule runs every 24 hours. | Schedule |
| On Demand | The rule runs only when you start it with Run Now. After a run, Run Now is available again only after 24 hours have passed since the time in the LAST EXECUTED ON column. Until then, it appears dimmed. | On Demand |
Choose Recurring if you add or update third-party sources often, so new duplicates are merged without you having to start the rule. Choose On Demand if you want to check your identification rules before each merge.
What the Merged Asset Looks Like
The merged result is always a single managed asset, because a Qualys sensor reports it. This is true even when the third-party source found the host first. The order in which sources discover a host does not decide which record is kept.