Identify Duplicate Assets
One host can reach your inventory through several sensors and connectors, and each one can create its own record. Use asset identification rules to find these duplicate assets, then review and compare the records before you merge them. An asset identification rule defines the attributes used to identify whether the assets found by third-party sources already exist in Qualys.
Navigate to: Inventory > Rules > Identification
Use this to
- Review the identification rules in your subscription.
- Match third-party assets against assets already in Qualys.
- Choose which connector sources a rule applies to.
- Understand why the same host appears more than once in your inventory.
- Compare duplicate records before you merge them.
Find Duplicate Assets
ETM finds duplicate assets through asset identification rules. Each rule lists the fields that two records must share to count as the same asset. When the rule runs, an asset must match all the selected fields for a match to occur.
View Asset Identification Rules
The Inventory > Rules > Identification tab lists the rules in your subscription and gives you three controls:
| Control | What it does |
|---|---|
| (a) Create New Rule | Creates a new asset identification rule. |
| (b) Reorder | Reorders the asset identification rules. |
| (c) Reset | Retains only the default system-generated asset identification rules. |
Create an Asset Identification Rule
Before you begin: Create the connectors whose assets you want the rule to cover. The Rule Applicability section is not visible if no connectors are created.
To create an asset identification rule:
- Go to Inventory > Rules > Identification, and click Create New Rule.
- Enter the rule name.
- Select the checkboxes next to the fields you need in the Available Fields section, and click the single arrow key icon. The fields move to the Selected Fields section. These fields are the attributes the rule uses to identify whether the assets found by third-party sources already exist in Qualys.
Select one field wherever you can, or at most two to three closely related fields such as IP and Mac Address. When the rule runs, an asset MUST match ALL the selected fields for a match to occur.
The rules you define here are offered as selections in the Connectors application. For more information, refer to the Asset Identification Rule Selection section. From the Connectors application, specify the attributes required for a given connector.
To move the selected fields from Available Fields to Selected Fields, click the Single arrow key icon. To move them back, click the Reverse arrow key icon.
To move all fields from Available Fields to Selected Fields, click the Double arrow key icon. To move them all back, click the Reverse arrow key icon. - Click the arrow next to the connectors you need, and select the connector sources. The assets scanned or discovered by these connectors are identified and imported into the CSAM inventory.
The Rule Applicability section is not visible if no connectors are created.
- The checkboxes next to all connectors are selected by default. Clear the checkbox for any connector you do not want to include.
- VMware ESXi version 1.0.0 is a prerequisite for importing assets scanned by the VMware ESXi connector from CSAM. If the VMware ESXi connector is created from the Qualys Connector application, the ESXI checkbox appears on the Create New Asset Identification Rule page.
- Click Create.
The rule is created. View its details on the Inventory > Rules > Identification tab, and use the Quick Actions menu of a rule to view, edit, or delete it. To delete several rules at once, select them and choose Delete from the Actions list.
Give each rule a name that identifies the source and the matching attribute it uses, so that you can tell the rules apart when you reorder them or select them in the Connectors application.
Review Duplicate Candidates
A duplicate candidate is a host that shows up as more than one record in your inventory. Each record is correct about what its own source saw. But because they describe one machine, its risk is counted twice and its software is listed twice.
Check the asset list on the Assets tab after you connect a third-party source. If the same host appears more than once, look for one of these common causes:
| Cause | What happens |
|---|---|
| Sensors run on different schedules | A third-party source finds an asset, and a Qualys sensor finds the same host again on its own schedule. Each one creates a record. |
| Several connectors report one host | Active Directory, ServiceNow, and Webhook connectors can each know the same machine by a different identifier. |
| Tracking methods differ | Scanned assets are tracked by IP, DNS name, or NetBIOS name. Two scans that track the same host in different ways do not recognize each other's records. |
| An agent is set up again | When a purge rule re-provisions an agent instead of uninstalling it, the agent creates a new asset. The old record stays until something removes it. |
| Cloud instances are rebuilt | A terminated instance keeps its record, and its replacement is found as a new asset. |
Before you merge anything, check that an identification rule covers the connector source that reported the extra record.
Compare Duplicate Records
Duplicate records are not equal. Where a record comes from decides what it holds and what happens to it when a rule runs.
| Record type | What it is |
|---|---|
| Managed asset | An asset that a Qualys sensor, such as the Qualys agent or scanner, has reported. It has its own scan and agent data. |
| Unmanaged asset | An asset that comes only from a third-party connector. No Qualys sensor has reported it. |
| Asset from several connectors | One asset with data from more than one connector source. Each source adds its own data to the same record. |
When you compare two records, look at the fields your identification rule uses:
- Match on all, not any. A record must match every selected field. Each field you add makes the rule stricter.
- Too many fields means the rule matches almost nothing, and the duplicates stay.
- One field that changes often, such as an IP address that moves between hosts, means the rule matches too much, and unrelated assets are merged.
When the records describe the same host, run the reconciliation rule to merge them into one managed asset. Then check the asset list again. Use a purge rule only for records that no source reports any more, because a purge rule deletes the matching assets from your inventory.