Documentation Center
AlienVault® USM Anywhere™

Adding Assets

Role Availability Read-Only Analyst   Manager

USM Anywhere provides different ways to add your assetsAn IP-addressable host, including but not limited to network devices, virtual servers, and physical servers.:

Asset Discovery

USM Anywhere discovers assets automatically if you have a cloudThe use of many computers connected over a network to run multiple programs or applications at the same time, instead of running them on a local device or network. provider (Amazon Web Services (AWSSuite of cloud computing services from Amazon that make up an on-demand computing platform.) or Microsoft AzureMicrosoft Azure is a cloud computing platform and infrastructure created by Microsoft for building, deploying, and managing applications and services through a global network of Microsoft-managed data centers.) or a hypervisorA middleman that intercepts hardware calls and converts them into something appropriate. This technique means that you can run multiple OSs simultaneously on one set of hardware. management application programming interface (API) (for example, VMware ESX). After deploying the sensorSensors are deployed into an on-premises, cloud, or multi-cloud environment to collect log and other security-related data. This data is normalized and then securely forwarded to USM Anywhere for analysis and correlation., and applying the API credentials, USM Anywhere discovers assets in these environments. See Running an Asset Discovery for more information.

Adding Assets by Using the Setup Wizard

The Setup Wizard is available on USM Anywhere when the sensor is not configured, and is displayed after each loginLog in (verb): Process in which an individual gains access to a computer system after providing sufficient credentials to authenticate their unique identity. Login (noun): User credentials, typically a username and matching password.. This wizard includes the initial tasks for getting USM Anywhere ready for deploymentEntire process involved in installation, configuration, startup, and testing of hardware and software in a specific environment.. As a result, the wizard collects as much data as possible to analyze and identify threats in your environment.

There are two ways to add assets to scan when using the Setup Wizard: by adding individual assets, or by using network ranges to add multiple assets.

Adding Individual Assets to Scans

The asset discovery option in the Setup Wizard enables you to add individual assets to scans.

To add individual assets using the Setup Wizard

  1. Inside the Setup Wizard, click Asset Discovery.
  2. Enter an asset name and either an IP address, or a fully qualified domain name (FQDN).
  3. Click Save.

Adding Multiple Assets to Scans Using a Network Range

The asset discovery option in the Setup Wizard enables you to add multiple assets in a network range to scans.

To add multiple assets in a network range using the Setup Wizard

  1. Inside the Setup Wizard, click Asset Discovery.
  2. Click Scan Networks.
  3. Enter a network name and a Classless Inter-Domain Routing (CIDRClassless Inter-Domain Routing, which provides a method for allocating IP addresses, routing Internet protocol packets, and subdividing networks. CIDR notation provides a syntax for specifying a range of IP addresses.) block to specify the subnet's IP address block that you want to scan.
  4. Click Scan.
  5. Depending on the length of the network range, this process can last more or less time.

    After the process finishes and the scan is completed, it displays the number of assets found. These assets are automatically added to USM Anywhere. In addition, a dynamic asset groupAsset groups are administratively created objects that group similar assets for specific purposes. is automatically created with these assets.

  6. Click Scan Another to start a new scan, or click Next to continue with the following screen.

To add assets by scanning your network

  1. Go to Data Sources > Sensors.
  2. Click the USM Anywhere Sensor with which you want to scan the network.
  3. Click Asset Discovery.
  4. Click Yes to scan the network. This step may be different depending on the sensor you have installed.
  5. Note: This option is not available for AWS sensors because the instances are automatically set.

    After the process finishes and the scan is completed, you can see the number of assets found. These assets are automatically added to USM Anywhere. In addition, a dynamic asset group is automatically created with these assets.

  6. Click Scan Another to start a new scan or click Next to continue with the following screen.

Adding Assets in the UI

Adding assets in the user interface (UI) enables you to manually add an asset. To do this, you have to know the IP addresses of the assets.

There are two ways of manually adding assets through the UI:

  • The quick way, by adding the asset name, and either an IP Address or FQDN, and then selecting a USM Anywhere Sensor.
  • The advanced way, which requires more data related to the asset that you are adding.

To add a new asset the quick way

  1. Go to Environment > Assets.
  2. In the upper right side of the page, select Actions > Quick to display the following fields above the asset list:
  3. Fields to add a new asset

  4. Enter the asset name, either the IP address or FQDN in the text boxes displayed above the asset list. Use the icon to display the rules that must satisfy a valid FQDN.
  5. If you have more than one USM Anywhere Sensor connected, select the Sensor from the drop-down menu.
  6. Select the Scan the newly added asset for asset details field if you want to scan the newly added asset. See Running Asset Scans when you are creating a new asset for more information.
  7. Click Save.

To add a new asset the advanced way

  1. Go to Environment > Assets.
  2. In the upper right side of the page, select Actions > Advanced.
  3. Create New Asset popup window

  4. Enter the information in each field.
  5. Fields in the Create New Asset window
    Field Meaning
    Name Name identifying the asset.
    Description A short description for the asset.
    Sensor

    This field displays if you have more than one sensor connected.

    Select the sensor you want to associate with the asset.

    IP Address IP address assigned to the asset.
    MAC Address The media access control MAC AddressA unique numeric value assigned by the manufacturer to identify a specific network device or computer, which allows communication over networks. Note that a device’s MAC address can be manipulated. assigned to the asset.
    FQDN

    Fully Qualified Domain Name.

    Icon Symbol that represents the asset.
    Asset Type Device type that identifies the asset. Select an option from the list. See USM Accepted Asset Types for more information. You can also click the icon to display all enabled asset types.
    Prevent Remote Scanning Select this field to avoid unauthenticated scans. If this option is selected, the following one is automatically hidden.
    Scan the newly added asset for asset details Select this field if you want to scan the new added asset. See Running Asset Scans when you are creating a new asset for more information.
    Compliance Scope Select if you want to include the asset in the Payment Card Industry Data Security Standards (PCI DSS) asset group in the Health Insurance Portability and Accountability Act (HIPAA) asset group, or in both. See Using USM Anywhere for PCI Compliance and USM Anywhere Compliance Templates for more information.
    Other Asset Fields Asset fields the user has created.

    Note: Every hour, USM Anywhere refreshes information about the PCI DSS or HIPAA asset groups. If you select the Compliance Scope field, you can see the asset inside the asset group after the following update.

  6. Click Save.

Adding Assets Through a CSV File

From the asset list view page, select Actions > Import Assets to add assets in large quantities to your environment from a CSV file. See Importing Assets from a CSV File for more information.