Auto Zone failed : conflicting device

[maged1]

there is a conflicting device with same hostname/Ip address in Zone ...

is there a way to remove duplicates automatically ??

[maged1]

1) i found up to three duplication for one asset

one zoned correctly , one zoned as RFC private and one with no Zone info .

2) Can i delete the assets found under Arcsight administration/Devices ???

[mschleich]

Dear Maged Mag,

ArcSight Network Model and Assets is a subject complex.

I had the same problem and according to Support, there is a way to do it but you need to launch a SQL command which could be risky thus it is better to ask to support or PS for this kind of help. To be sure that you will not make mistake.

Firstly check that all connectors has a proper URI and assigned to local zone

Then Switch off Auto asset creation is BEST PRACTICE.

There is a solution to prevent duplicate asset. It is to remove the asset auto-creation on ESM.

There are two filters on ESM to put at false (depends of ESM version😞

/All Filters/ArcSight System/Asset Auto Creation/Connector Asset Auto Creation Controller

/All Filters/ArcSight System/Asset Auto Creation/Device Asset Auto Creation Controller

and one parameter to change in server.properties manager file:

autocreate.sensor.asset.enabled=false

ESM automated asset creation is not reliable and this is why ArcSight Support recommend to use the Asset Import Connector in place of ESM.

Before changing anything ask Support to be sure that this what you need.

You have explanation in the Console User Guide.

They explain how it works following which solution you use to import asset by csv file or by Asset Import connector.

I hope this information will be useful

I have to see PS soon to discuss about this point, if I receive more interesting information I make a feedback on Protect724.

Thanks

Kind Regards

Michael

[mschleich]

Hi Maged Mag,

Before deleting asset in Device, you need to disable asset auto-creation because it will recreated later.

You need to be sure what you do before deleting something.

You may delete duplicate item but DO NOT DELETE the folder Devices;

I advice you to read the document Console User Guide on that subject Network Model, Asset Auto-creation, etc..

Thanks

Regards

Michael