Smart Rules

What are Smart Rules?

A Smart Rule is a filter that you can use to organize assets into Smart Groups. Use an asset-based Smart Rule to organize assets based on the filters selected.

What are Smart Groups?

Smart Groups are groups, created by non-administrators, that contain assets. These Smart Groups are automatically associated with:

• Read permissions for all groups the group creator is a member of
• Full Control permissions for all groups the user is a member of, and where the user has the Asset Management and Smart Rule Management permissions for

How are Smart Rules useful?

When you use a Smart Rule to register assets as Smart Groups, you can run Discovery Scans and monitor and view assets.Smart rules can:

• Save time: Automate actions based on vulnerability findings or asset changes saves time for IT and security teams.
• Ensure consistency: Actions are taken consistently, reducing the risk of human error or missed steps in critical processes.
• Reduce risk: By automating responses to vulnerabilities and security issues, Smart Rules help reduce the time window in which systems remain vulnerable.
• Enhance compliance: Smart Rules help ensure that remediation efforts align with compliance requirements, automating compliance workflows and reporting.
• Improve your security posture: Automating security processes leads to quicker identification and remediation of risks, improving overall security.

Important information about Smart Rules

• The BeyondInsight user must be a member of the Administrators group or be assigned the Full Control permission on the Asset Management and the applicable Smart Rule Management feature(s) to be able to create and edit Smart Rules.
• Users assigned Read Only permissions on these features may only view the details of Smart Rules.
• Smart Rules update results automatically, ensuring assets match the criteria and are current.
• You can create address groups or Active Directory queries from the Configuration page to use as Smart Rule filters.
• You can use more than one filter to refine or extend the scope of assets in a Smart Rule. Filters can be joined with and (match ALL criteria) or or (match ANY criteria) conditions. If you select to match ALL, every indented filter must be set to True for an asset to be included. If you select to match ANY, only one of the indented filter items must be set to True for an asset to be included. The screen capture shows a filter example that includes all assets in the EMEA domain that are either servers or workstations.

⚠️

Important

Virtual machine asset onboarding with predefined Smart Rules has been deprecated as of BeyondInsight and Password Safe 24.1. However, you can still create custom Smart Rules to onboard virtual machine assets.

For upgrades to BeyondInsight and Password Safe 24.1 and later releases:

• the Virtualized Devices category for Smart Rules still displays but any Smart Rules based on this category are marked as inactive.
• Child Smart Rule filters that use any of the following built-in rules are removed:
  • Microsoft Hyper-V
  • Parallels
  • Recent Virtual Servers not in Password Safe
  • Virtual Servers
  • Virtual Workstations
  • VMware vSphere
  • Xen

Smart Rule processing

A Smart Rule processes and updates information in Smart Groups when certain actions occur, such as the following:

• The Smart Rule is created, or edited and saved.
• A timer expires.
• You manually process the rule.

ℹ️

Note

The Process action on the Smart Rules page does not apply to managed account and managed system Quick Group Smart Rules, because these only run once (upon creation) and cannot be triggered to run again.

• A Smart Rule with Smart Rule children triggers the children to run before the parent completes.
• Managed account Smart Rules with selection criteria Dedicated Account process when a change to a mapped group is detected. This can occur in the following scenarios:
  • A new user logs on.
  • The group refreshes in Active Directory by an administrator viewing or editing the group in BeyondInsight's Configuration > Role Based Access > User Management page.

Available Smart Rule filters for assets

Predefined Smart Group categories

Create an asset-based Smart Rule

1. From the left menu in BeyondInsight, click Smart Rules.
   The Smart Rules page displays.

2. Select Asset in the Smart Rule type filter drop-down list.

3. Click Create Smart Rule.
   The Create New Asset Based Smart Rule page displays.

4. Select a Category from the drop-down list.

5. Enter a name and description.

6. Optionally, uncheck the Active setting.

   📘

   Note

   By default, the Smart Rule is set to Active, so it is always available for processing. Disable the active setting if you do not want to process the rule.

7. In the Selection Criteria section, select the inclusion filter (ANY or ALL).

8. From the drop-down, select one of the available conditions and complete the associated fields.

9. Optionally, click Add a new group to further refine the condition.

10. Optionally, click Add another condition to add more conditions to your Smart Rule.

11. In the Actions section, select the action you want to happen when the Smart Rule processes:

12. Optionally, click Add another action to add more actions to your Smart Rule.
13. Click Create Smart Rule.
    The Smart Rule saves.
14. Optionally, click View Results to view the Smart Rule contents.

    ⚠️

    Important

    Because the Smart Rule must process to display the results we recommend viewing the results using only the Show asset as Smart Group action before adding additional actions that may make changes to accounts and assets in your network.

    Once you confirm the rule contains the correct items, you can add additional actions to the Smart Rule.
    The Assets page displays with the Smart Rule's asset, domain, operating system, description, asset type, solution, and last-updated date.
    A banner displays if the rule is actively processing.

View a Smart Rule's details

1. From the left menu in BeyondInsight, click Smart Rules.
   The Smart Rules page displays.
2. Locate the rule you want to view from the Smart Rules list.
3. Click > View Details.
   The Smart Rule's details panel displays with the rule's selection criteria and actions.

Edit a Smart Rule

1. From the left menu in BeyondInsight, click Smart Rules.
   The Smart Rules page displays.
2. Locate the rule you want to edit from the Smart Rules list.
3. Click > Edit Smart Rule.
   The Create New Asset Based Smart Rule page displays with the existing selection criteria.
4. Modify, add, or remove conditions and/or actions. See Create an asset-based Smart Rule, above, for procedures.
5. Click Save Changes.
   The Smart Rule saves.

Deactivate a Smart Rule

1. From the left menu in BeyondInsight, click Smart Rules.
   The Smart Rules page displays.
2. Locate the rule you want to deactivate from the Smart Rules list.
3. Click > Deactivate Smart Rule.
   • If the Smart Rule is not included in another (active) Smart Rule's filter or action, the rule deactivates.
   • If the Smart Rule is included in another (active) Smart Rule's filter or action does not deactivate, an error message displays.

Clone a Smart Rule

1. From the left menu in BeyondInsight, click Smart Rules.
   The Smart Rules page displays.
2. Locate the rule you want to clone from the Smart Rules list.
3. Click > Clone Smart Rule.
   The Create New Asset Based Smart Rule page displays with the existing selection criteria.
4. Optionally, change the name.
   By default, cloned Smart Rules append the existing rule name with _1 (for example, SmartRule_1).
5. Modify, add, and/or remove conditions and actions. See Create an asset-based Smart Rule, above, for procedures.
6. Click Save Changes.
   The Smart Rule saves.

Process a Smart Rule

1. From the left menu in BeyondInsight, click Smart Rules.
   The Smart Rules page displays.
2. Locate the rule you want to process from the Smart Rules list.
3. Click > Process.
   A success message displays, and the rule processes.
4. Modify, add, or remove conditions and/or actions. See Create an asset-based Smart Rule, above, for procedures.
5. Click Save Changes.
   The Smart Rule saves.

View a Smart Rule's results

⚠️

Important

Because the Smart Rule must process to display the contents in the grid, we recommend viewing the results using only the Show as Smart Group action and before adding additional actions that may make changes to accounts and assets in your network.

Once you confirm the rule contains the correct items, you can add additional actions to the Smart Rule.

1. From the left menu in BeyondInsight, click Smart Rules.
   The Smart Rules page displays.
2. Locate the rule you want to view from the Smart Rules list.
3. Click > View Results.
   The Assets page displays with the Smart Rule's asset, domain, operating system, description, asset type, solution, and last-updated date.
   A banner displays if the rule is actively processing.

Audit Smart Rules

1. From the left menu in BeyondInsight, click Configuration.
   The Configuration page displays.
2. In the General column, click Smart Rule Options.
   The User Audits page displays.
3. Optionally, select a date range from the Create Date filter.
   By default, the date range is set to Last 30 days.
4. In the Filter by drop down, select Section.
   A new Section filter displays.
5. In the Section filter, select Smart Rule.
   The list automatically filters to only Smart Rules with an action within the date range set.
6. Locate a rule you want to audit.
7. Click the information icon to the right of the Smart Rule to view details about the associated action.

Delete a Smart Rule

❗️

WARNING

Deleting a Smart Rule is an unrecoverable operation.

1. From the left menu in BeyondInsight, click Smart Rules.
   The Smart Rules page displays.
2. Locate the rule you want to delete.
3. Click > Delete.
   A confirmation message displays.
4. Click Delete.
   The rule is immediately deleted.

Perform other Smart Rule actions

The below sections detail how to perform various actions with Smart Rules, such as:

• Viewing the results of processed Smart Rules from the grid
• Editing, cloning, deactivating, deleting, and auditing Smart Rules
• Configuring Smart Rules Options
• Viewing Smart Rules statistics

View results of a Smart Rule from the grid

From the Smart Rules grid, you can view the results of any processed Smart Rule using the View Results row action, as follows:

1. From the left menu in BeyondInsight, click Smart Rules.
2. Click the vertical ellipsis to the right of the Smart Rule.
3. Select View Results to go to the associated grid where the contents of the Smart Rule are listed.

ℹ️

Note

• View Results displays only if you have permissions to the grid corresponding to the Smart Rule, i.e.; Assets, Managed Accounts, Managed Systems.
• The Smart Rule must be saved with Show <entity> as Smart Group selected under Actions to view the results.

Edit a Smart Rule

1. From the left menu in BeyondInsight, click Smart Rules.

2. Click the vertical ellipsis to the right of the Smart Rule.

3. Select Edit Smart Rule.

4. Make the necessary changes and then click Save Changes.

ℹ️

Note

To view the contents of a Smart Rule when creating a new rule or editing an existing rule:

• Once the rule is saved, click View Results.
• You are taken to the associated grid, where the contents of the Smart Rule are listed.
• If the rule is actively processing, a banner displays letting you know that.

ℹ️

Note

• View Results displays only if you have permissions to the grid corresponding to the Smart Rule, i.e.; Assets, Managed Accounts, Managed Systems.
• The Smart Rule must be saved with Show <entity> as Smart Group selected under Actions to view the results.

ℹ️

Note

Because the Smart Rule must process to display the contents in the grid, we recommend viewing the results using only the Show as Smart Group action and before adding additional actions that may make changes to accounts and assets in your network. Once you have confirmed the rule contains your desired items, you can then add additional actions to the Smart Rule.

Clone a Smart Rule

You can clone custom or predefined Smart Rules.

1. From the left menu in BeyondInsight, click Smart Rules.

2. Click the vertical ellipsis button for the Smart Rule you wish to clone, and then select Clone.

3. If you are using the multi-tenant feature, select the organization from the list, and then click Clone Smart Rule.

4. Select the newly cloned Smart Rule from the grid, click the vertical ellipsis button, select View Details, and then edit the Smart Rule filters as needed.

5. Click Save Changes.

ℹ️

Note

Cloned Smart Rules have full (read/write) user group permissions.

Deactivate a Smart Rule

You cannot delete predefined Smart Rules. However, if you have several smart groups, you can mark unused Smart Rules as inactive.

ℹ️

Note

A Smart Rule that is used in another Smart Rule cannot be deleted or marked as inactive.

An inactive Smart Group is no longer displayed in the Smart Group browser pane until marked active again.

To deactivate a Smart Rule:

1. From the left menu in BeyondInsight, click Smart Rules.

2. Select the Smart Group or multiple Smart Groups, and then click Deactivate above the grid.

Delete a Smart Rule

1. From the left menu in BeyondInsight, click Smart Rules.

2. Select one or more Smart Rules.

3. Click the Trash Can icon above the grid. You can also click the vertical ellipsis to the right of a single Smart Rule and select Delete.

ℹ️

Note

Built in Smart Rules cannot be deleted. These are identified by the Lock icon.

ℹ️

Note

A Smart Rule that is used in another Smart Rule cannot be deleted or marked as inactive.

Audit Smart Rules

To audit new or edited Smart Rules:

1. Go to Configuration > General > User Audits.
2. Select Section from the Filter by dropdown.
3. Select Smart Rule from the Section dropdown.
4. Click the information icon to the right of the Smart Rule.
   • If a Smart Rule is added, the Add Details pane displays with all added information.
   • If a Smart Rule is edited, the Edit Details pane displays with all edited information.

Configure Smart Rule options

From Configuration > General > Smart Rule Options, you can configure multi-worker node usage, the number of Smart Rule threads per type, and the failure thresholds using the Smart Rule Omni Worker Options.

Multi-Node Processing is turned off by default. Enable this to allow assignment of Smart Rules to process specific worker nodes. Choosing a worker node for a Smart Rule to process is accomplished by setting the Target Processing to Workgroup action on the Smart Rule in question. When enabled, this allows multiple Omni Workers to process Smart Rules.

⚠️

Important

For the following options to be available, you must enable Multi-Node Processing. An all Omni Worker restart is required to enable this processing.

• Asset Threads: (Default 5) Choose a number of threads to use for processing asset based Smart Rules.
• Managed Account Threads: (Default 5) Choose a number of threads to use for processing managed account based Smart Rules.
• Managed System Threads: (Default 5) Choose a number of threads to use for processing managed system based Smart Rules.
• Policy User Threads: (Default 5) Choose a number of threads to use for processing policy based Smart Rules.
• Force Re-queued if stale: (Default 12) Choose a number of hours after which an unprocessed Smart Rule is considered stale and re-queued for processing.
• Failure cool off threshold: (Default 5) Choose a number of times to let a Smart Rule process fail after which a cool-off period is observed.
• Failure cool off skip time: (Default 60) Choose a number of minutes to wait before trying to process the Smart Rule again after reaching the failure cool off threshold.

Click Update Smart Rule Omni Worker Options when you have finished setting the options.

Additional multi-node processing information

The Multi-Node Processing feature was added to allow more granular control over the performance of smart rule processing.

Impact of multi-node processing

Multi-node processing is a combination of features:

• Controls the number of nodes and threads per node that are used for processing different types of Smart Rules.
• Restricts the processing of certain Smart Rules to specific nodes if required. This might come into play if the Smart Rule is built on a directory query that only one worker node has access to. Trying to process a Smart Rule like this across all Omni Workers would result in occasional failures if the node doing the processing lacks the necessary access to run the directory query.
• Controls certain behaviors in failure scenarios. The defaults should be sufficient, but are adjustable to give more control to support assisting customers in this area.
• When multi-node processing is turned off, then Smart Rule processing occurs on a single node using N threads, where N is configurable per Smart Rule TYPE in the configuration user interface (Asset Threads, Managed Account Threads, Managed System Threads, and Policy User Threads). While better than the historical single-threaded model, this can still be a lot of work for the Omni Worker and might cause poor performance in other areas (password rotations, event forwarding, etc.).
• When multi-node processing is turned on, then Smart Rule processing is shared across ALL worker nodes, using N threads per worker node, where N is configurable per Smart Rule TYPE in the configuration user interface (Asset Threads, Managed Account Threads, Managed System Threads, and Policy User Threads).
• The default setting for each Smart Rule type is 5 threads. The valid range is between 1 and 20 threads.
• Changes to the multi-node processing settings, as well as changes to thread counts and changes to failure scenario handling, can be made anytime but do not take effect until all Omni Worker services are restarted. This restart is a manual step. There is no risk to enabling or disabling these settings during production times, but you will not see any change in processing until Omni Worker services are restarted.

Overall best practices

The Multi-Node Processing setting is turned off by default. Turning it on is beneficial if multiple worker nodes or Omni Workers are available, and if the existing Omni Workers are running at full capacity. If turning this feature on doesn’t help Omni Worker performance, support should be contacted.

The lower the thread count, the less benefit you may get from turning this setting on. However, setting the thread count too high can also result in problems if your Omni Worker or worker nodes are not powerful enough to handle the load. Start with the default and adjust up or down as necessary.

Reason for multi-node processing

Before this feature was added, Smart Rule processing was only supported in a single-threaded model running in RemManagerService. Moving it to Omni Worker allows it to be multi-threaded on a single node. Adding the multi-node option allows Smart Rule processing to be scaled out even further.

Multi-node processing environment

This feature is used in an environment with multiple worker nodes or Omni Workers, where an Omni Worker is taxed by Smart Rule processing.

Assign a rule to a node

If multi-node processing is turned on and a Smart Rule contains a specific criteria or action that only works if executed on a particular worker node, then that Smart Rule is expected to get an action of Targeted to Workgroup set. The Omni Worker or worker node that executes this Smart Rule should be manually set to the same work group under Worker Nodes. Some examples of criteria or actions that only work on a particular node are directory queries that run on a specific network, or database account onboarding that runs on a specific network. Any network-specific Smart Rules are likely candidates to target a specific worker node.

Troubleshooting methods

• Smart Rule Grid

  Three optional columns have been added to the Smart Rule grid to give some extra visibility into Smart Rule processing: Processed Date (checks to see if any rules were not processed recently), Successful Attempts, and Failed Attempts. Other columns that are helpful are Reprocessing Limit, Average Time, Last Attempt, and Processing Status.

• Dynamic Dashboard

  Troubleshooting also includes checking the Omni Worker Dynamic dashboard in the user interface (administrators only). There you can see the Omni Worker agents, queued messages, messages sent to dead-letter (undeliverable letters, reached the limit of processing attempts), and messages actively being processed.

• Health Dashboard

  This dashboard shows stats regarding issues on worker nodes, slowest Smart Rules, failed Smart Rules, and errors in the system.

• Logfiles

  There is one log file per Omni Worker. Because this can be hard to read across environments, we have added the System Event Viewer and System Event Settings features. Enabling System Event Database Recording logs error or warning messages from across the system into the BeyondInsight database so they can be viewed and searched using the System Event Viewer. Purging these events from the database is configurable. The default is 5 days.

Issues with feature

The feature has been developed to avoid deadlocks, race conditions, memory leaks, etc., as part of our development and QA process. However, it is possible that some issues still exist. Contact BeyondTrust Support with any issues that arise for resolution.

Changed behaviors in the database

On its own, multi-node processing does not make changes in the database. Any database changes to schemas, tables, views, procedures, etc., that are required for this and other features in BeyondInsight are made during an upgrade, whether this feature is enabled or not. If the Enable System Event Database Recording setting is turned on, then database entries are made for warnings or errors in the system. Purging is enabled for this data, and the time frame is configurable.

Logged nodes

Each Omni Worker has its own logs. Logging takes place across multiple nodes when this setting is turned on. The System Event Viewer shows any issues that are occurring.

Failover processing

Existing support for worker node or Omni Worker service failover also encompasses the Smart Rule processing function. In the event of a failover situation, the secondary node picks up where the primary node leaves off.

View and select Smart Rules processing statistics

The Smart Rules grid displays some processing statistics by default. Additional Smart Rules processing statistics, such as Processed Date, Successful Attempts, and Failed Attempts are available and can be displayed in the Smart Rules grid.

To add this information to the grid:

1. From the left menu in BeyondInsight, click Smart Rules.

2. Click the Column chooser icon in the upper right of the grid.

3. Click the desired column to add that information to the grid.

   • Check marks indicate columns currently displayed.
   • You can remove a displayed column by clicking the column name in the Column chooser list.
   • If there are more columns displayed than can fit in the width of the screen, a scroll bar appears at the bottom of the grid. It may be necessary to scroll sideways to view any additional columns.