2 Replies Latest reply: Oct 12, 2017 4:41 AM by kingka RSS

Asset Groups in Reports

kingka Apprentice

Awhile ago I set up a couple asset groups to include our entire space <except> for the firewall IP and the web proxy IP. (Those two items kicked a lot of false positives.) Anyway, these wind up being dynamic assets with large numbers of "hosts". I'm trying to build the "Most Vulnerable Assets" table (similar to the one in Understanding Risk Report), but don't want to see these two asset groups. Even if I put in a single asset group, these two appear in the list and throw the numbers off. If I try to create a specific list of Assets to "include", I get these two items anyway. How can I ignore the two generic (exclusionary) asset groups in the report?

 

Kent

  • Re: Asset Groups in Reports
    coyote10a Novice

    You might be able to solve this with two new asset groups.

     

    (a) Create a static asset list with the firewall and proxy,

    (b) Create a combination asset list using the NOT parameter, you should be able to filter the firewall and proxy. It should consist of everything (your main asset)  + NOT(firewall and proxy group)

     

    Then use the combination asset as part of your reports.

    • Re: Asset Groups in Reports
      kingka Apprentice

      In the end, I created a list of "exclusion IPs" and use this with "NOT" in any Asset Filters where I'm searching by IP address. It works pretty well, it skips the noisy IPs but doesn't give me artificial asset groups to deal with. Thanks!