Highlighted
Outstanding Contributor.
Outstanding Contributor.

Re: Device Asset ID not created for devices

Hi Randy,

This option can be disabled on ESM. You can look for the below property in <Manager Home/config/>server.properties file:

autocreate.sensor.asset.enabled=true

Or you can re-run the manager setup to change this properties:

Change this value to false. It will stop creating the assets from the scanner feeds.

Regards,

Anirudh

0 Likes
Reply
Highlighted
Outstanding Contributor.. Outstanding Contributor..
Outstanding Contributor..

Re: Device Asset ID not created for devices

Hi Anirud - thanks so much for the quick reply.  Very much appreciated.

0 Likes
Reply
Highlighted
Trusted Contributor.. Trusted Contributor..
Trusted Contributor..

Re: Device Asset ID not created for devices

We have ArcSight version 5.2. We had the same problem of null Device Asset IDs. The problem was corrected by setting the Zones in the Assets. After that the IDs were populated.

0 Likes
Reply
Highlighted
Acclaimed Contributor.
Acclaimed Contributor.

Re: Device Asset ID not created for devices

Hi Randy,

Additional ref:

0 Likes
Reply
Highlighted
Trusted Contributor.
Trusted Contributor.

Re: Device Asset ID not created for devices

There is one more reason for null assets, if your ESM won't receive IP address and host name in the base events then it won't be able create auto assets. I have resolved this issue by proper DNS resolution for assets in the connector level and everything worked

0 Likes
Reply
Highlighted
Absent Member.
Absent Member.

Re: Device Asset ID not created for devices

Why would the Attacker Asset ID be blank on assets in the asset model just from some connectors. We have a server that is in the asset model and has a Asset ID, But in some of the list for /all rules/real-time rules/intrustion monitoring/worm outbreak/ it will be listed with the IP address and no Attacker Asset ID.

0 Likes
Reply
Highlighted
Trusted Contributor.
Trusted Contributor.

Re: Device Asset ID not created for devices

Hi,

It could be issue with hostname resolution. Check whether those IP address resolve it's hostname at connector level.

0 Likes
Reply
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.