Working with assets
The following sections provide instructions on viewing and exporting a list of assets with missing patches, identifying vulnerabilities, and assets discovered by BMC Discovery.
It also provides instructions on mapping assets to endpoints in the endpoint manager and adding tags.
Asset type | Description | Working with assets |
|---|---|---|
Managed asset | The Assets page in the application lists the managed, scanned, and discovered assets. On the Managed Assets page, you can add tags to the assets. To enter tag information, you export the assets data to a CSV file or click Import Tags to download a CSV template. Later, you upload the updated CSV file back in Automation Console. | |
Scanned assets | The Scanned Assets tab shows a list of assets imported from a vulnerability scan file, their mapping to endpoints in an endpoint manager , and the number of vulnerabilities identified for each asset. After you import a vulnerability scan file in Automation Console, assets are automatically mapped to endpoints managed by the endpoint manager. During auto-mapping, Automation Console matches the FQDN or hostname and then the IP address of an asset in a scan to the endpoint. Vulnerabilities are not automatically mapped to the remediation content unless assets are mapped to the endpoints. If an asset is decommissioned in the endpoint manager and an operation is not created for remediating missing patches or vulnerabilities, the asset gets unmapped in Automation Console. The asset status in Automation Console appears as Manually Unmapped. If the asset is recommissioned in Server Automation, the asset does not get automatically mapped again. You can always manually map the asset in Automation Console. Automation Console may not always correctly auto-map all the endpoints because the firewalls, load balancers, and proxies can cause discrepancies in mapping. You can manually map each unmapped asset to a single endpoint only. If you map an asset to an endpoint, which is already mapped, the existing mapping is overwritten and the asset is mapped to the new endpoint. On the Scanned Assets page, you can add tags to the assets. To enter tag information, you export the assets data to a CSV file or click Import Tags to download a CSV template. Later, you upload the updated CSV file back in Automation Console. In addition to the existing filters, tags provide another criterion to select a particular asset or a group of assets while creating a vulnerability remediation operation. | |
Discovered assets | The Discovered Assets tab shows the assets that are discovered by BMC Discovery. You configure the BMC Discovery connector to ensure that unmanaged, unscanned, and a total number of discovered assets are sent to Automation Console. If you change the BMC Discovery endpoint in the connector later, the data discovered from the previous BMC Discovery instance is also retained. The total number of assets for each category appears at the top of the page. You can perform a basic or advanced search using filters to look for specific data. |
To view and export managed assets
On the Assets > Managed Assets page, view the following details:
- The total number of assets appears near the tab title.
- To search for an asset, enter a search term, and click
.You can search using the host name, IP address, or operating system.
To view the list of unique missing patches for any asset, do the following:
- Click the link against any asset in the Missing Patches column.
The Risks > Missing Patches page shows the unique missing patches, patch age, severity, classification, and CVE IDs for each missing patch for the particular asset. - Click Clear Filters to view all unique missing patches across all assets.
To view more information about the missing patches, see Working-with-risks.
To export managed assets data
On the Assets > Managed Assets page, click Export and enter a name to save the results in a CSV file.
If you filter data using the advanced filter options and then export, then the filtered data appears in the CSV file.
To view and export assets from a vulnerability scan
On the Assets > Scanned Assets page, view the following details:
- Total number of assets imported from a scan appears near the tab title.
- Asset name, IP address, status, source, operating system, and vulnerabilities identified for each asset.
To view a list of vulnerabilities identified for an asset, do the following:
- Click the link against any asset in the Vulnerability column.
The Risks > Vulnerabilities page shows the vulnerabilities and their details. - Click Clear Filters to view all vulnerabilities imported from the latest scan.
To view more information about vulnerabilities, see Working-with-risks.
To search for an asset, enter an asset or host name or IP address, and click Search.
To show tags as additional columns on the Scanned Assets page, click Display Tags, select a tag and click Apply. The new tag appears as a column.
For example, if you have added a Location tag to the scanned assets, after you choose it, a new Location column which shows the location for each asset appears.
To export scanned assets data with vulnerabilities
On the Assets > Scanned Assets page, click Export and enter a name to save the results in a CSV file.
If you filter data using the advanced search options and then export, filtered data appears in the CSV file.
To map and unmap scanned assets
On the Assets > Scanned Assets page, do the following:
- Select an asset and click Map.
- Select an endpoint and save changes.
You can use the Operating System or Operating System Vendor filters to select the endpoints. The asset status changes to Mapped and the mapped endpoint appears under the asset host name.
To remove mapping, select one or more assets with the status as Mapped, and click Remove Mapping. You cannot remove mapping for assets for which a remediation operation is created and scheduled.
To import tags for managed and scanned assets
On the Assets > Managed Assets or the Assets > Scanned Assets page, do the following:
- Click Import Tags and either download the CSV template, or download the assets data in a CSV format.
If you want to download filtered data, perform an advanced search and then click Export to get the assets data in a CSV file. If using the exported CSV file, in the Tags column, add tag keys and values to be associated with the assets, in a key:value format.
OR
If using the CSV template, provide asset data such as the asset ID, scanned host name, IP address and then add tag keys and values, in a key:value format.
For example, the CSV template is in the following format, in which you provide the asset data and tags:Asset ID
Scanned Hostname
Scanned IP Address
Tags
<asset_name>
<host name>
<IP_address>
LOCATION: Pune; OWNER: Admin
<asset_name>
<host name>
<IP_address>
LOCATION: USA; OS: Redhat Linux
- Attach the updated CSV file, and then click Import.
- Click Display Tags and select the tags that you want to be displayed on the Managed Assets or Scanned Assets page.
Tagging for scanned and managed assets is handled separately.
To remove tags
To remove a tag, remove its value from key:value pair(s) in the exported CSV file, and then import the same file again in Automation Console. For example, to remove the tag LOCATION: Pune, remove Pune and import the CSV file again.
To view assets from BMC Discovery
On the Assets > Discovered Assets page, view the following details:
- The key performance indicators (KPIs) show the following information:
- Total Discovered Assets: Total number of discovered assets by BMC Discovery. (Except excluded resources based on provided Exclude IPs/Hosts/Range list).
- Unmanaged Assets: Total number of assets that are found by BMC Discovery, but are not mapped to endpoints in TrueSight Server Automation.
Unscanned Assets: Total number of assets, either discovered, or mapped in Server Automation, but not yet scanned for vulnerabilities.
If an auto-mapped asset is unmapped from the Scanned Assets page, it gets counted in the Unscanned Assets.
- To view all assets for a category, click the KPI link.
For example, if you click Total Discovered Assets, all assets discovered by BMC Discovery appear in the list (Except excluded resources based on provided Exclude IPs/Hosts/Range list). - Host name, IP address, operating system, and services for the assets.
- To search for an asset, enter a search term, and click Search.
You can search using the host name, IP address, or operating system of the asset. - If you want to remove an asset, remove it first from TrueSight Server Automation and then from BMC Discovery. This change gets reflected in Automation Console based on the Data Refresh Cycle configured on the Configuration > Service Account page. Services affecting such assets are also removed from Automation Console.
- If you delete an asset from BMC Discovery, which is not managed in Automation Console but is available only in BMC Discovery, the services at risk for the asset are not removed and the data remains unchanged in the Top 10 Business Services at Risk widget on the dashboard.
To perform an advanced search for managed assets
On the Assets > Managed Assets page, do the following:
- Click Advanced filter and choose one or more of the following options:
- Asset
- Operating System
- Operating System Vendor
- Risk Owner
- Risk Score
- Unique Missing Patch
- Click Clear filters to view unfiltered data.
To perform an advanced search for scanned assets
On the Assets > Scanned Assets page, do the following:
Click Advanced Search and choose one or more of the following options:
- Asset
- Asset Tag
- Operating System
- Risk Owner
- Risk Score
- Source
- Status
- Vulnerability Name
- Click Clear Filters to go back and view unfiltered data.
To perform an advanced search for Discovered assets
On the Assets > Discovered Assets page, do the following:
- Click Advanced Search and choose one or more of the following options:
- Asset
- Business Service
Operating System
- Click Clear Filters to go back and view unfiltered data.