Smart Rules
Use Smart Rules to organize assets
A Smart Rule is a filter that you can use to organize assets into Smart Groups. Use an asset-based Smart Rule to organize assets based on the filters selected.
Note
- The BeyondInsight user must be a member of the Administrators group or be assigned the Full Control permission on the Asset Management and the applicable Smart Rule Management feature(s) to be able to create and edit Smart Rules.
- Users assigned Read Only permissions on these features may only view the details of Smart Rules.
When a non-administrator user creates a Smart Group, the Smart Group is automatically associated with:
- Read permissions for all groups the user is a member of
- Full Control permissions for all groups the user is a member of and has the Asset Management and Smart Rule Management permissions for
Use a Smart Rule to register assets as Smart Groups. This allows you to:
- Run Discovery Scans
- Monitor and view assets
Smart Rules update results automatically, ensuring assets match the criteria and are current.
Use Smart Rule filters and Smart Groups
There are many built-in filters available that you can use when creating Smart Rules. You can also create address groups or Active Directory queries from the Configuration page to use as Smart Rule filters.
You can use more than one filter to refine or extend the scope of assets in a Smart Rule. Filters can be joined with and (match ALL criteria) or or (match ANY criteria) conditions. If you select to match ALL, every indented filter must be set to True for an asset to be included. If you select to match ANY, only one of the indented filter items must be set to True for an asset to be included. The screen capture shows a filter example that includes all assets in the EMEA domain that are either servers or workstations.
Smart Rule filters
Asset Smart Rule filters
| Address Group | Create a group of IP addresses. |
|---|---|
| Asset Fields | Group the Smart Rule by asset fields, such as, Asset Name, Domain or DNS, Risk, and Kind. You can include more than one asset field filter in the Smart Rule to refine the results. |
| Assigned Attributes | Create a filter based on an attribute. If the attribute is unassigned on a particular asset, you can choose to include or exclude the asset from the rule. |
| Child Smart Rule | You can reuse a Smart Rule to save time when creating new Smart Rules. This is especially useful if the Smart Rule is a complicated set of filters. Reusing a Smart Rule further refines the assets that will be a part of the Smart Rule. |
| Cloud Assets | Filter assets on the cloud connector. |
| Directory Query | Create an Active Directory or an LDAP query to include or exclude assets in the selected domain. |
| Installed Software | Filter on any combination of installed software. |
| Operating System | Filter on any combination of OS. Operating systems included in the list are those detected in your network. Assets with no OS detected, can be included or excluded from the rule. |
| Processes | Filter on any combination of processes. |
| Services | Filter by any combination of services. |
| Software Version | Filter by software version. The software that you can filter on is determined by the software that is discovered during the scan. |
| User Account Attribute | Filters user accounts by SID or privilege. You can filter on both. If either value is not selected then it will be ignored. Using this filter you can determine if any users have administrator privileges that might no longer be required. You can create a Smart Rule using this filter and set the email alert action to notify you when a user account with admin privileges is detected. |
| Windows Events | Filter by Windows events that are available in the Windows Event Viewer. For example, Application, Security, or System. |
| Workgroup | Filter by workgroup. |
Predefined Smart Group categories
| Smart Group category | Description |
|---|---|
| Agents and Scanners | Detects assets where BeyondInsight scanners are deployed. |
| Assets and Devices | Includes default Smart Groups for all assets and all assets labeled as workstations. |
| Intelligent Alerts | Includes Smart Groups that detect assets added since the previous day, and mobile assets with critical vulnerabilities. Intelligent Alerts are inactive by default. |
| Servers | Includes Smart Groups that detect mail server, web server, database server, domain controller, and SCADA assets. Only the Web Servers Smart Group is marked as active. |
| Virtualized Devices | Includes Smart Groups for virtual environments, including Microsoft Hyper-V and Parallels. Assets detected as virtual environments belong to these Smart Groups. This default category also includes two Smart Groups: Virtual Servers and Virtual Workstations. Assets that are servers or workstations might not be detected, and as a result, not be included in the Smart Group. For example, the asset might be a router or unknown, resulting in exclusion from the Smart Group. |
Note
Virtual machine asset onboarding with predefined Smart Rules has been deprecated as of BeyondInsight and Password Safe 24.1. However, you can still create custom Smart Rules to onboard virtual machine assets.
For upgrades to the BeyondInsight and Password Safe 24.1 release, the Virtualized Devices category for Smart Rules still displays in the UI; however, any Smart Rules based on this category are marked as inactive.
For upgrades to the 24.1 release, Child Smart Rule filters that use any of the following built-in rules are removed:
- Microsoft Hyper-V
- Parallels
- Recent Virtual Servers not in Password Safe
- Virtual Servers
- Virtual Workstations
- VMware vSphere
- Xen
Create Smart Rules
You can configure an asset-based Smart Rule to:
- Create Smart Groups
- Send email alerts with a list of assets
- Set attributes on assets
- Create a ticket with a list of assets
- Set scanner pooling
Create an asset based Smart Rule
-
From the left menu in BeyondInsight, click Smart Rules.
-
Leave Asset selected for the Smart Rule type filter.
-
Click Create Smart Rule.
-
Select a category.
-
Enter a name and description.
-
By default, the Smart Rule is set to Active (yes), so it is always available for processing. Disable the active setting to ensure the rule is not processed.
-
Select the filters in the Selection Criteria section.
-
From the Actions section, select one of the following:
| Action | Description |
|---|---|
| Export Data | Select to manage a Smart Group for the BMC Remedy connector. |
| Mark each asset for deletion | Select to create a Smart Group that contains assets to be marked for deletion. |
| Mark each asset inactive | Assets detected as inactive are no longer be displayed on the Assets page or in reports. |
| Send an email Alert | Select and enter the email addresses for notification when the rule criteria is matched. Emails are only sent if the list of assets that match the rule is changed from the last time the rule was processed. |
| Set attributes on each asset | Select the attribute type from the list, and then select the attribute. |
| Set Scanner Properties | Select one or more scanners to lock to the Smart Group. |
| Set attributes on each asset | Select attributes for each asset. |
| Show asset as Smart Group | When selected, the rule is displayed in the Smart Groups pane as a Smart Group. You can select the Smart Group to filter the list of assets in the Smart Groups pane. You can also select the default view to display on the Assets page when the Smart Group is selected. Smart Groups are also used for running scans and registering for patch updates. |
- Click Create Smart Rule.
Note
To view the contents of a Smart Rule when creating a new rule or editing an existing rule:
- Once the rule is saved, click View Results.
- You are taken to the associated grid, where the contents of the Smart Rule are listed.
- If the rule is actively processing, a banner displays letting you know that.
Note
- View Results displays only if you have permissions to the grid corresponding to the Smart Rule, i.e.; Assets, Managed Accounts, Managed Systems.
- The Smart Rule must be saved with Show <entity> as Smart Group selected under Actions to view the results.
Note
Because the Smart Rule must process to display the contents in the grid, we recommend viewing the results using only the Show as Smart Group action and before adding additional actions that may make changes to accounts and assets in your network. Once you have confirmed the rule contains your desired items, you can then add additional actions to the Smart Rule.
Smart Rule processing
A Smart Rule processes and updates information in Smart Groups when certain actions occur, such as the following:
- The Smart Rule is created, or edited and saved.
- A timer expires.
- You manually kick off the processing by selecting the Smart Rule from the grid on the Smart Rules page, and then click Process.
Note
The Process action from the grid on the Smart Rules page does not apply to managed account and managed system Quick Group Smart Rules, because these only run once upon creation and cannot be triggered to run again.
- A Smart Rule with Smart Rule children triggers the children to run before the parent completes.
- Managed account Smart Rules with selection criteria Dedicated Account process when a change to a mapped group is detected. This can occur in the following scenarios:
- A new user logs on.
- The group refreshes in Active Directory by an administrator viewing or editing the group in Configuration > Role Based Access > User Management.
Change the processing frequency for a Smart Rule
By default, Smart Rules process when asset changes are detected. The assets in the Smart Rule are then dynamically updated. For Smart Rules that require more intensive processing, you might want Smart Rules to process less frequently.
To provide more restrictive processing, you can select alternate frequency settings to override the default processing. The Smart Rules process in the selected time frame (for example, the rule processes once a week).
When creating a new Smart Rule or updating an existing one, select your desired frequency from the Reprocessing limit list in the Details section.
Note
A Smart Rule is always processed when first saved or updated.
Perform Other Smart Rule Actions
The below sections detail how to perform various actions with Smart Rules, such as:
- Viewing the results of processed Smart Rules from the grid
- Editing, cloning, deactivating, deleting, and auditing Smart Rules
- Configuring Smart Rules Options
- Viewing Smart Rules statistics
View results of a Smart Rule from the grid
From the Smart Rules grid, you can view the results of any processed Smart Rule using the View Results row action, as follows:
- From the left menu in BeyondInsight, click Smart Rules.
- Click the vertical ellipsis to the right of the Smart Rule.
- Select View Results to go to the associated grid where the contents of the Smart Rule are listed.
Note
- View Results displays only if you have permissions to the grid corresponding to the Smart Rule, i.e.; Assets, Managed Accounts, Managed Systems.
- The Smart Rule must be saved with Show <entity> as Smart Group selected under Actions to view the results.
Edit a Smart Rule
-
From the left menu in BeyondInsight, click Smart Rules.
-
Click the vertical ellipsis to the right of the Smart Rule.
-
Select Edit Smart Rule.
-
Make the necessary changes and then click Save Changes.
Note
To view the contents of a Smart Rule when creating a new rule or editing an existing rule:
- Once the rule is saved, click View Results.
- You are taken to the associated grid, where the contents of the Smart Rule are listed.
- If the rule is actively processing, a banner displays letting you know that.
Note
- View Results displays only if you have permissions to the grid corresponding to the Smart Rule, i.e.; Assets, Managed Accounts, Managed Systems.
- The Smart Rule must be saved with Show <entity> as Smart Group selected under Actions to view the results.
Note
Because the Smart Rule must process to display the contents in the grid, we recommend viewing the results using only the Show as Smart Group action and before adding additional actions that may make changes to accounts and assets in your network. Once you have confirmed the rule contains your desired items, you can then add additional actions to the Smart Rule.
Clone a Smart Rule
You can clone custom or predefined Smart Rules.
-
From the left menu in BeyondInsight, click Smart Rules.
-
Click the vertical ellipsis button for the Smart Rule you wish to clone, and then select Clone.
-
If you are using the multi-tenant feature, select the organization from the list, and then click Clone Smart Rule.
-
Select the newly cloned Smart Rule from the grid, click the vertical ellipsis button, select View Details, and then edit the Smart Rule filters as needed.
-
Click Save Changes.
Note
Cloned Smart Rules have full (read/write) user group permissions.
Deactivate a Smart Rule
You cannot delete predefined Smart Rules. However, if you have several smart groups, you can mark unused Smart Rules as inactive.
Note
A Smart Rule that is used in another Smart Rule cannot be deleted or marked as inactive.
An inactive Smart Group is no longer displayed in the Smart Group browser pane until marked active again.
To deactivate a Smart Rule:
-
From the left menu in BeyondInsight, click Smart Rules.
-
Select the Smart Group or multiple Smart Groups, and then click Deactivate above the grid.
Delete a Smart Rule
-
From the left menu in BeyondInsight, click Smart Rules.
-
Select one or more Smart Rules.
-
Click the Trash Can icon above the grid. You can also click the vertical ellipsis to the right of a single Smart Rule and select Delete.
Note
Built in Smart Rules cannot be deleted. These are identified by the Lock icon.
Note
A Smart Rule that is used in another Smart Rule cannot be deleted or marked as inactive.
Audit Smart Rules
To audit new or edited Smart Rules:
- Go to Configuration > General > User Audits.
- Select Section from the Filter by dropdown.
- Select Smart Rule from the Section dropdown.
- Click the information icon to the right of the Smart Rule.
- If a Smart Rule is added, the Add Details pane displays with all added information.
- If a Smart Rule is edited, the Edit Details pane displays with all edited information.
Configure Smart Rule options
From Configuration > General > Smart Rule Options, you can configure multi-worker node usage, the number of Smart Rule threads per type, and the failure thresholds using the Smart Rule Omni Worker Options.
Multi-Node Processing is turned off by default. Enable this to allow assignment of Smart Rules to process specific worker nodes. Choosing a worker node for a Smart Rule to process is accomplished by setting the Target Processing to Workgroup action on the Smart Rule in question. When enabled, this allows multiple Omni Workers to process Smart Rules.
Important
For the following options to be available, you must enable Multi-Node Processing. An all Omni Worker restart is required to enable this processing.
- Asset Threads: (Default 5) Choose a number of threads to use for processing asset based Smart Rules.
- Managed Account Threads: (Default 5) Choose a number of threads to use for processing managed account based Smart Rules.
- Managed System Threads: (Default 5) Choose a number of threads to use for processing managed system based Smart Rules.
- Policy User Threads: (Default 5) Choose a number of threads to use for processing policy based Smart Rules.
- Force Re-queued if stale: (Default 12) Choose a number of hours after which an unprocessed Smart Rule is considered stale and re-queued for processing.
- Failure cool off threshold: (Default 5) Choose a number of times to let a Smart Rule process fail after which a cool-off period is observed.
- Failure cool off skip time: (Default 60) Choose a number of minutes to wait before trying to process the Smart Rule again after reaching the failure cool off threshold.
Click Update Smart Rule Omni Worker Options when you have finished setting the options.
Additional multi-node processing information
The Multi-Node Processing feature was added to allow more granular control over the performance of smart rule processing.
Impact of multi-node processing
Multi-node processing is a combination of features:
- Controls the number of nodes and threads per node that are used for processing different types of Smart Rules.
- Restricts the processing of certain Smart Rules to specific nodes if required. This might come into play if the Smart Rule is built on a directory query that only one worker node has access to. Trying to process a Smart Rule like this across all Omni Workers would result in occasional failures if the node doing the processing lacks the necessary access to run the directory query.
- Controls certain behaviors in failure scenarios. The defaults should be sufficient, but are adjustable to give more control to support assisting customers in this area.
- When multi-node processing is turned off, then Smart Rule processing occurs on a single node using N threads, where N is configurable per Smart Rule TYPE in the configuration user interface (Asset Threads, Managed Account Threads, Managed System Threads, and Policy User Threads). While better than the historical single-threaded model, this can still be a lot of work for the Omni Worker and might cause poor performance in other areas (password rotations, event forwarding, etc.).
- When multi-node processing is turned on, then Smart Rule processing is shared across ALL worker nodes, using N threads per worker node, where N is configurable per Smart Rule TYPE in the configuration user interface (Asset Threads, Managed Account Threads, Managed System Threads, and Policy User Threads).
- The default setting for each Smart Rule type is 5 threads. The valid range is between 1 and 20 threads.
- Changes to the multi-node processing settings, as well as changes to thread counts and changes to failure scenario handling, can be made anytime but do not take effect until all Omni Worker services are restarted. This restart is a manual step. There is no risk to enabling or disabling these settings during production times, but you will not see any change in processing until Omni Worker services are restarted.
Overall best practices
The Multi-Node Processing setting is turned off by default. Turning it on is beneficial if multiple worker nodes or Omni Workers are available, and if the existing Omni Workers are running at full capacity. If turning this feature on doesn’t help Omni Worker performance, support should be contacted.
The lower the thread count, the less benefit you may get from turning this setting on. However, setting the thread count too high can also result in problems if your Omni Worker or worker nodes are not powerful enough to handle the load. Start with the default and adjust up or down as necessary.
Reason for multi-node processing
Before this feature was added, Smart Rule processing was only supported in a single-threaded model running in RemManagerService. Moving it to Omni Worker allows it to be multi-threaded on a single node. Adding the multi-node option allows Smart Rule processing to be scaled out even further.
Multi-node processing environment
This feature is used in an environment with multiple worker nodes or Omni Workers, where an Omni Worker is taxed by Smart Rule processing.
Assign a rule to a node
If multi-node processing is turned on and a Smart Rule contains a specific criteria or action that only works if executed on a particular worker node, then that Smart Rule is expected to get an action of Targeted to Workgroup set. The Omni Worker or worker node that executes this Smart Rule should be manually set to the same work group under Worker Nodes. Some examples of criteria or actions that only work on a particular node are directory queries that run on a specific network, or database account onboarding that runs on a specific network. Any network-specific Smart Rules are likely candidates to target a specific worker node.
Troubleshooting methods
-
Smart Rule Grid
Three optional columns have been added to the Smart Rule grid to give some extra visibility into Smart Rule processing: Processed Date (checks to see if any rules were not processed recently), Successful Attempts, and Failed Attempts. Other columns that are helpful are Reprocessing Limit, Average Time, Last Attempt, and Processing Status.
-
Dynamic Dashboard
Troubleshooting also includes checking the Omni Worker Dynamic dashboard in the user interface (administrators only). There you can see the Omni Worker agents, queued messages, messages sent to dead-letter (undeliverable letters, reached the limit of processing attempts), and messages actively being processed.
-
Health Dashboard
This dashboard shows stats regarding issues on worker nodes, slowest Smart Rules, failed Smart Rules, and errors in the system.
-
Logfiles
There is one log file per Omni Worker. Because this can be hard to read across environments, we have added the System Event Viewer and System Event Settings features. Enabling System Event Database Recording logs error or warning messages from across the system into the BeyondInsight database so they can be viewed and searched using the System Event Viewer. Purging these events from the database is configurable. The default is 5 days.
Issues with feature
The feature has been developed to avoid deadlocks, race conditions, memory leaks, etc., as part of our development and QA process. However, it is possible that some issues still exist. Contact BeyondTrust Support with any issues that arise for resolution.
Changed behaviors in the database
On its own, multi-node processing does not make changes in the database. Any database changes to schemas, tables, views, procedures, etc., that are required for this and other features in BeyondInsight are made during an upgrade, whether this feature is enabled or not. If the Enable System Event Database Recording setting is turned on, then database entries are made for warnings or errors in the system. Purging is enabled for this data, and the time frame is configurable.
Logged nodes
Each Omni Worker has its own logs. Logging takes place across multiple nodes when this setting is turned on. The System Event Viewer shows any issues that are occurring.
Failover processing
Existing support for worker node or Omni Worker service failover also encompasses the Smart Rule processing function. In the event of a failover situation, the secondary node picks up where the primary node leaves off.
View and select Smart Rules processing statistics
The Smart Rules grid displays some processing statistics by default. Additional Smart Rules processing statistics, such as Processed Date, Successful Attempts, and Failed Attempts are available and can be displayed in the Smart Rules grid.
To add this information to the grid:
-
From the left menu in BeyondInsight, click Smart Rules.
-
Click the Column chooser icon in the upper right of the grid.
-
Click the desired column to add that information to the grid.
- Check marks indicate columns currently displayed.
- You can remove a displayed column by clicking the column name in the Column chooser list.
- If there are more columns displayed than can fit in the width of the screen, a scroll bar appears at the bottom of the grid. It may be necessary to scroll sideways to view any additional columns.
Updated 5 days ago