Rules

Assets rules let you automatically assign properties to a set of assets defined by custom search criteria. You may for example automatically add any asset reporting the nginx service enabled to a Web group.

In other words, setting up a rule is essentially the same as executing a bulk edit operation from the inventory, periodically.

Rules are processed every hour. Therefore, a newly created asset or one that just got updated might not immediately have its properties updated following the rules.

In the case of conflicting rules, the resulting behavior is unspecified. Creating rules with common assets but contradictory actions is discouraged.

Only Cyberwatch administrators have the permission to define rules.

Actions

Actions define the operations to perform on the assets that match the filters. They can attribute groups, compliance repositories, the criticality, the category or the policies on the matched assets.

If a rule sets for example the criticality of an asset, and then that asset’s criticality gets manually edited, the rule will set its criticality again at its next execution.

To undo the effects of a rule on assets that do not match the filters anymore, you can define opposite actions. These actions are executed only once, at the first execution of the rule that detects that the assets do not match the filters anymore. Past that execution, the rule will not affect the unmatched assets anymore, unless they later match the filters again.

The set of assets that match the filters of a rule may change either because the assets changed, or because the rule’s filters got edited. In both cases, the actions will be performed on all the assets that match the filters, regardless of whether they already matched them, while opposite actions will be performed only on assets that matched the filters at the previous execution but do not match them anymore.

Opposite actions may be left blank, and do not have to specifically reflect the other actions. When for instance the filters of a rule have criteria that may fluctuate, leaving the opposite actions blank avoids causing repeated changes on unstable assets.

Create a rule

To create a rule, open the inventory and use the search filters to restrict the view to the set of assets the rule should apply to. Then, click Bulk edit and Create a rule.

Note that rules do not take into account the global group filter set with the funnel icon at the top right corner of the screen. Rules are always applied globally.

At their creation, rules are executed in the background. Their result will usually be observable after a few seconds.

Manage the rules

You can see and edit the rules from menu Settings > Rules. From there, you can redefine the actions of a rule. Saving a rule triggers its immediate execution.

It is currently not possible to modify the filters of a rule to apply it to a different set of assets. However, you can still create a new rule and delete the previous one.