ESM auto-creates assets for the ArcSight SmartConnectors connected to it. Creating assets for SmartConnectors is affected by the following conditions:
ESM does not create an asset if there is no Network defined for the SmartConnector. This could happen if a SmartConnector is added incorrectly, or if an unforeseen condition occurs, such as a database corruption. If you do not specify a Network for the Connector during setup, ESM uses the default RFC1918 system zones.
ESM does not create an asset unless the event is a base event: that is, an event generated by the device whose events the SmartConnector represents. For example, ESM creates an asset for the SmartConnector if the event is a firewall event, but it does not create an asset for the SmartConnector if the event is an ArcSight internal event, such as heartbeat events with the Manager.
ESM does not create an asset for the SmartConnector if the Connector Asset Auto Creation Controller filter (at /All Filters/ArcSight System/Asset Auto Creation/Connector Asset Auto Creation Controller) is specially configured to exclude traffic from assets in this zone.
If the Connector Asset Auto Creation Controller filter is configured to exclude Connectors in a certain zone, such as a zone designated for VPN traffic that comes and goes from the network, then ESM does not create an asset for that Connector every time VPN traffic comes in from that Connector. This ensures that assets are not created unnecessarily.
For more about the Asset Auto Creation Auto Controller filter and how to configure it, see the ArcSight System and ArcSight Administration Standard Content Guide. For information about an optional ArcSight Foundation, refer to the Standard Content Guide for that Foundation. ESM documentation is available on the ESM documentation page.