Creating Assets for Network Devices

By default, the Manager also auto-creates assets for the network devices that originate the events. This feature can be configured during Manager setup using the Manager Setup Wizard.

Creating assets for devices is affected by the following conditions:

• The Manager does not create an asset if there is no Network defined for the SmartConnector. This could happen if a SmartConnector is added incorrectly, or if an unforeseen condition occurs, such as a database corruption. If you do not specify a Network for the Connector during setup, ESM uses the default RFC1918 system zones.

• The Manager does not create an asset unless the event is a base event: that is, an event generated by the device whose events the SmartConnector represents. For example, the Manager creates an asset for the device if the event is a firewall event, but it cannot create an asset for the device if the event is an ArcSight internal event, such as heartbeat events with the Manager.

• The Manager does not create an asset for the device if the Connector Asset Auto Creation Controller filter (at /All Filters/ArcSight System/Asset Auto Creation/Device Asset Auto Creation Controller) is specially configured to exclude traffic from assets in this zone.

  If the Connector Asset Auto Creation Controller filter is configured to exclude events from Connectors in a certain zone, such as a zone designated for VPN traffic that comes and goes from the network, then the Manager does not create an asset for the device the Connector represents every time VPN traffic comes in from that Connector. This ensures that The Manager does not create unnecessary assets.

For more about the Connector Asset Auto Creation Auto Controller filter and how to configure it, see the ArcSight System and ArcSight Administration Standard Content Guide. If you have an optional ArcSight Foundation, refer to the same guide for information on that Foundation. ESM documentation is available on the ESM documentation page.