Troubleshooting asset profiles that exceed the normal size threshold

IBM QRadar generates the following system notification when the accumulation of data under a single asset exceeds the configured threshold limits for identity data.

The system detected asset profiles that exceed the normal size threshold

Explanation

The payload of the notification shows a list of the top five most frequently deviating assets and why the system marked each asset as a growth deviation. As shown in the following example, the payload also shows the number of times that the asset attempted to grow beyond the asset size threshold.

Feb 13 20:13:23 127.0.0.1 [AssetProfilerLogTimer] 
com.q1labs.assetprofile.updateresolution.UpdateResolutionManager: 
[INFO] [NOT:0010006101][192.0.2.83/- -] [-/- -]
The top five most frequently deviating asset profiles between 
Feb 13, 2015 8:10:23 PM AST and Feb 13, 2015 8:13:23 PM AST: 
[ASSET ID:1003, REASON:Too Many IPs, COUNT:508], 
[ASSET ID:1002, REASON:Too many DNS Names, COUNT:93], 
[ASSET ID:1001, REASON:Too many MAC Addresses, COUNT:62]

When the asset data exceeds the configured threshold, QRadar blocks the asset from future updates. This intervention prevents the system from receiving more corrupted data and mitigates the performance impacts that might occur if the system attempts to reconcile incoming updates against an abnormally large asset profile.

Required user action

Use the information in the notification payload to identify the assets that are contributing to the asset growth deviation and determine what is causing the abnormal growth. The notification provides a link to a report of all assets that experienced deviating asset growth over the past 24 hours.

After you resolve the asset growth deviation in your environment, you can run the report again.

Click the Log Activity tab and click Search > New Search.
Select the Deviating Asset Growth: Asset Report saved search.
Use the report to identify and repair inaccurate asset data that was created during the deviation.