Asset reconciliation exclusion rules
With each asset update that enters IBM
QRadar, the asset reconciliation
exclusion rules apply tests to the MAC address, NetBIOS host name, DNS host name, and IP address in
the asset update.
By default, each piece of asset data is tracked over a two-hour period. If any one piece of identity data in the asset update exhibits suspicious behavior two or more times within 2 hours, that piece of data is added to the asset blacklists. Each type of identity asset data that is tested results in a new blacklist.
Tip: QRadar
excludes events based on data that is received in the event, not on any data that is later inferred
or linked to the event.
In domain-aware environments, the asset reconciliation exclusion rules track the behavior of asset data separately for each domain.
The asset reconciliation exclusion rules test the following scenarios:
| Scenario | Rule response |
|---|---|
| When a MAC address is associated to three or more different IP addresses in 2 hours or less | Add the MAC address to the Asset Reconciliation Domain MAC blacklist |
| When a DNS host name is associated to three or more different IP addresses in 2 hours or less | Add the DNS host name to the Asset Reconciliation Domain DNS blacklist |
| When a NetBIOS host name is associated to three or more different IP addresses in 2 hours or less | Add the NetBIOS host name to the Asset Reconciliation Domain NetBIOS blacklist |
| When an IPv4 address is associated to three or more different MAC addresses in 2 hours or less | Add the IP address to the Asset Reconciliation Domain IPv4 blacklist |
| When a NetBIOS host name is associated to three or more different MAC addresses in 2 hours or less | Add the NetBIOS host name to the Asset Reconciliation Domain NetBIOS blacklist |
| When a DNS host name is associated to three or more different MAC addresses in 2 hours or less | Add the DNS host name to the Asset Reconciliation Domain DNS blacklist |
| When an IPv4 address is associated to three or more different DNS host names in 2 hours or less | Add the IP address to the Asset Reconciliation Domain IPv4 blacklist |
| When a NetBIOS host name is associated to three or more different DNS host names in 2 hours or less | Add the NetBIOS host name to the Asset Reconciliation Domain NetBIOS blacklist |
| When a MAC address is associated to three or more different DNS host names in 2 hours or less | Add the MAC address to the Asset Reconciliation Domain MAC blacklist |
| When an IPv4 address is associated to three or more different NetBIOS host names in 2 hours or less | Add the IP address to the Asset Reconciliation Domain IPv4 blacklist |
| When a DNS host name is associated to three or more different NetBIOS host names in 2 hours or less | Add the DNS host name to the Asset Reconciliation Domain DNS blacklist |
| When a MAC address is associated to three or more different NetBIOS host names in 2 hours or less | Add the MAC address to the Asset Reconciliation Domain MAC blacklist |
You can view these rules on the Offenses tab by clicking Rules and then selecting the asset reconciliation exclusion group in the drop-down list.