Documentation Center
AlienVault® USM Anywhere™

Adding Assets

  Role Availability   Read-Only   Analyst   Manager

USM Anywhere provides different ways to add your assetsAn IP-addressable host, including but not limited to network devices, virtual servers, and physical servers.:

Asset Discovery

USM Anywhere discovers assets automatically if you have a cloudThe use of many computers connected over a network to run multiple programs or applications at the same time, instead of running them on a local device or network. provider (AWSSuite of cloud computing services from Amazon that make up an on-demand computing platform. or AzureMicrosoft Azure is a cloud computing platform and infrastructure created by Microsoft for building, deploying, and managing applications and services through a global network of Microsoft-managed data centers.) or a hypervisorA middleman that intercepts hardware calls and converts them into something appropriate. This technique means that you can run multiple OSs simultaneously on one set of hardware. management API (VMware ESX). After deploying the sensorSensors are deployed into an on-premises, cloud, or multi-cloud environment to collect log and other security-related data. This data is normalized and then securely forwarded to USM Anywhere for analysis and correlation., and applying the API credentials, USM Anywhere discovers assets in these environments. See Running an Asset Discovery for further information.

Adding Assets by Using the Setup Wizard

The Setup Wizard is available on USM Anywhere while the sensor is not configured and it will be displayed after each loginLog in (verb): Process in which an individual gains access to a computer system after providing sufficient credentials to authenticate their unique identity. Login (noun): User credentials, typically a username and matching password.. This wizard includes the initial tasks for getting AlienVault USM Anywhere ready for deploymentEntire process involved in installation, configuration, startup, and testing of hardware and software in a specific environment.. As a result, the wizard collects as much data as possible to analyze and identify threats in your environment. Once the sensor has been configured, the Setup Wizard will not be available.

There are two ways you add assets to monitor: you can scan your network using network ranges or you can add assets manually.

Adding Assets Manually

The asset discovery option in the Setup Wizard allows you to add assets manually.

To add assets manually through the Setup Wizard

  1. Click the Asset Discovery tab inside the Setup Wizard.
  2. Type an asset name and IP Address or FQDN.
  3. Click Save.

Adding Assets Through Scan Networks

The asset discovery option in the Setup Wizard allows you to scan networks.

  1. Click the Asset Discovery tab inside the Setup Wizard.
  2. Click Scan Networks.
  3. Type a network name and a CIDRClassless Inter-Domain Routing, which provides a method for allocating IP addresses, routing Internet protocol packets, and subdividing networks. CIDR notation provides a syntax for specifying a range of IP addresses. block to specify the subnet's IP Address block that you want to scan.
  4. Click Scan.
  5. Depending on the network range, this process can last more or less time.

    After the process finishes and the scan is completed, it displays the number of assets found. These assets are added to USM Anywhere. In addition, a dynamic asset groupAsset groups are administratively created objects that group similar assets for specific purposes. is created with these assets.

  6. Click Scan Another to start a new scan or click Next to continue with the following step.

Adding Assets by scanning your network

  1. Navigate to DATA SOURCES > SENSORS.
  2. The Sensors page displays.

  3. Click on the sensor you want to scan the network.
  4. Click the Asset Discovery tab.
  5. An Asset Discovery popup window displays.
  6. Click Yes to scan the network. This step may be different depending on the sensor you have installed.
  7. Note: In AWS Sensors this option is not available because the instances are automatically set.

    After the process finishes and the scan is completed, you can see the number of assets found. These assets are added to USM Anywhere. In addition, a dynamic asset group is created with these assets.

  8. Click Scan Another to start a new scan or click Next to continue with the following step.

Adding Assets Manually in the UI

This feature allows you to add an asset manually. You have to know the IP addresses of the assets.

There are two ways of adding assets manually through the UI

  • The quick way, just adding the asset name, an IP Address or FQDN, and selecting a sensor.
  • The advanced way, which requires more data related to the asset you are adding.

To add a new asset in a quick way

  1. Navigate to ENVIRONMENT > ASSETS.
  2. Click Actions > Quick at the upper right-hand.
  3. Type the asset name and the IP or FQDN in the boxes displayed above the asset list.
  4. If you have more than one sensor connected, select the sensor from the pull-down menu.
  5. Click Save.

To add a new asset in an advanced way

  1. Navigate to ENVIRONMENT > ASSETS.
  2. Click Actions > Advanced at the upper right-hand.
  3. A popup window displays.

  4. Type the information in each field.
  5. Fields in the Create New Asset window
    Field Meaning
    Name Name identifying the asset
    Description A short description for the asset
    Sensor

    This field displays if you have more than one sensor connected

    Select the sensor you want to associate with the asset

    IP Address IP address assigned to the asset
    MAC Address MAC AddressA unique numeric value assigned by the manufacturer to identify a specific network device or computer, which allows communication over networks. Note that a device’s MAC address can be manipulated. assigned to the asset
    FQDN Fully Qualified Domain Name
    Icon Symbol that represents the asset
    Asset Type Device type that identifies the asset. Select an option from the list, see USM Accepted Asset Types
    Prevent Remote Scanning Select this field to avoid unauthenticated scans. If this option is selected, the following one is automatically hidden
    Scan the newly added asset for asset details Select this field if you want to scan the new added asset, see Running Asset Scans when you are creating a new asset for further information
    Compliance Scope Select if you want to include the asset in the PCI DSS asset group and/or in the HIPAA asset group. See Using USM Anywhere for PCI Compliance and USM Anywhere Compliance Templates
    Other Asset Fields Asset fields the user has created

    Note: Every hour, USM Anywhere refreshes information about the PCI DSS or HIPAA asset groups. If you select the Compliance Scope field, you will see the asset inside the asset group after the following update.

  6. Click Save.