Asset Configuration Setup

Settings Description

The asset configuration page is a table of existing asset configurations. The table can be sorted by columns and filtered using the Search input field. You can create a new configuration using the Create New Asset Configuration button, or edit an existing one by clicking the Edit button in the Actions column of the selected configuration. If needed, you can import a new configuration or export an existing one using the Import and Export buttons in the table header.

Managing Configurations

To create your own configuration or edit an existing configuration, click the Create New Asset Configuration button or click Edit in the Actions section. A form for creating (or editing) a configuration will then be displayed.

List of Fields in a Configuration

note

All fields, except Asset Time-to-Live, are required.

The list of fields that make up a configuration:

• General Settings - General asset information (configuration name, asset name, asset time-to-live, category, index)

  note

  The Asset Time-to-Live field accepts an integer starting from 1 with a time unit suffix (s - seconds, m - minutes, h - hours, d - days). The value cannot be composite. Examples: 20h, 2d, 30s.

• Basic Fields - Fields constituting the core asset information

• Additional Fields - Fields containing optional asset information

• Sources - A list of sources used to create the asset base, including rules for mapping source fields to basic/additional fields

• Linking - Source fields where their relationships are configured

• Prioritization - A rule defining the priority for extracting basic/additional fields from sources

tip

The Asset Name parameter supports tokens based on basic and additional fields. Example usage: $hostname$ - $os$.

In the Asset Lifetime field, you can enter an integer from 1 with a time unit specification (s - seconds, m - minutes, h - hours, d - days). The value cannot be composite. Examples: 20h, 2d, 30s.

Adding a New Source

To add a source, click the Add Source button. A submenu will appear, which needs to be expanded for configuration.

Source configuration consists of the following items:

• Name - The source name
• Source Index - The index where the required information is stored
• Time Interval - The time period for data collection
  note

  The Time Interval field specifies the filter interval magnitude for the @timestamp field. The filter is used to limit data sampling from the source. The interval is specified as a positive number with time units, e.g., 90d (90 days), 24h (24 hours), 15m (15 minutes). Supported time units: m - minute, h - hour, d - day, w - week, M - month, y - year. For more details on time units, see the OpenSearch documentation. If the value is specified incorrectly, the Inventory Processor will log an error and apply the default value 1h (1 hour). If the time interval is specified in minutes, the right filter boundary corresponds to the current moment (now). Otherwise, the right boundary equals the start of the previous hour (now-1h/h). The left boundary is calculated as the difference between the right boundary and the time interval. The filter includes all source documents where @timestamp is greater than or equal to the left boundary and less than or equal to the right boundary.

• Field Mapping Rules - A mapping that defines how fields from the source correspond to fields specified in the Basic Fields and Additional Fields parameters

note

To add more fields to the mapping, use the Add Fields button.

Linking

To set up linking fields, click the Add Key Field button. A submenu will appear, which needs to be expanded for configuration.

Key field configuration consists of:

• Sources - Which sources need to be linked
• Fields - Selection of fields specified in the Basic Fields and Additional Fields parameters

Prioritization

To set up prioritization, click the Add Priority button. A submenu will appear, which needs to be expanded for configuration.

Priority configuration consists of:

• Field - The field for which priority is set
• Field Extraction Order - Extracting the field from the source according to the specified priority
• To add more sources to the priority rule, click the Add Source button.

note

The Priority Level indicates the sequential order for extracting the field from a source. The value will first be extracted from the source with the lowest priority level number. If identical priorities are set, the field in the asset will be represented as an array.

Setup Process

To navigate to the configuration list page, select Assets in the navigation menu under the Inventory section.

To configure a configuration, click the Create New Asset Configuration button or click Edit in the Actions section. This will take you to the configuration setup form.

After accessing the form, fill in the fields in the General Settings tab, then define the basic and additional fields in the Fields tab.

note

The Basic Field Coefficient determines the degree of influence a field has on the similarity between two assets. It is used when an asset is obtained from source events, and a decision must be made whether to create a new asset in the database or update an existing one. The decision is made by calculating a similarity coefficient between the two assets.

Similarity is determined by the similarity coefficient k calculated by the formula k = c/(a+b-c), where:

• c - the number of matching basic fields between the existing and the new asset
• a - the number of basic fields in the existing asset
• b - the number of basic fields in the new asset

Assets are considered similar if k >= 0.5 when b <= 5 or if k >= 0.554 when b > 5. The Basic Field Coefficient multiplies the presence of the field in the sums a, b and c. If the coefficient is 0, the field is not counted in the sums. If the coefficient is 1, the field is counted once in the sums. If the coefficient is n, the field will be counted n times in the sums.

In the Sources tab, add the necessary sources and configure them.

In the Linking tab, link sources and fields if necessary.

Then go to the Prioritization tab and set up field priorities.

When all necessary settings are configured, click the Save button. You will be automatically redirected to the configuration list page and receive a corresponding notification.