How to filter assets without hostname from discovery process

Hey ​@prasadp87 - the scan will return all assets that exist, but they wouldn’t be onboarded as a managed system unless there is a smart rule to do so. 

There’s a few general notes I can recommend, but the implementation does depend on the architecture set up. (Mandatory disclosure note: If full support of modifying your specific environment is desired, that would be the realm of professional services.)

General Notes

Refine Discovery Scan

I would recommend investigating the IPs rather than hostnames (e.g. windows scan expected but it’s a linux device, etc.) to refine the discovery scan to be more effective to only bring online systems that are anticipated.

Smart Rule Targets

You can tag the assets that match the regex for an IPv4 address with an attribute (or show as smart group) and exclude that attribute (or smart group if you choose to show as smart group) from onboarding as a managed system.

The target smart group members:

Hello ​@prasadp87 

You can use a regular expression. 

This one worked for me.

^(?!^(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$).*
 

Regards,

John

Hey Everyone, 

Thank you for the responses and providing solution. I am sort of new to BT environment and I am still trying to figure out which smart rule is being used for conversion of assets to managed system in password safe. 

Can someone suggest me, how can I find the exact rule used for this? Do we have any specific criteria that being used in rules which I can look for and find that one specific rule?

I know it would environment specific but just trying to understand if any common thing that I can use to find out.

Thanks,

Prasad

 Here is a quick exclusion statement for the asset onboarding Smart Rule that prevents assets with only an IP address from being onboarded. This is useful if you want to exclude assets that lack a DNS hostname. 

Put an exclusion statement like this:

        Selection Criteria > Asset fields > Asset Name > does NOT contain: \d+\.\d+\.\d+\.\d

Screenshot: 

Hey ​@prasadp87 - the scan will return all assets that exist, but they wouldn’t be onboarded as a managed system unless there is a smart rule to do so. 

 

There’s a few general notes I can recommend, but the implementation does depend on the architecture set up. (Mandatory disclosure note: If full support of modifying your specific environment is desired, that would be the realm of professional services.)

 

General Notes

Refine Discovery Scan

I would recommend investigating the IPs rather than hostnames (e.g. windows scan expected but it’s a linux device, etc.) to refine the discovery scan to be more effective to only bring online systems that are anticipated.

 

Smart Rule Targets

You can tag the assets that match the regex for an IPv4 address with an attribute (or show as smart group) and exclude that attribute (or smart group if you choose to show as smart group) from onboarding as a managed system.

 

The target smart group members:

 

Effective asset scanning and discovery are essential for a successful Privileged Access Management (Password Safe) deployment within the IAM workspace—you can’t protect what you don’t know exists.

Protecting assets and accounts relies on a healthy DNS environment, robust identity management, and effective asset management. Neglecting these foundations undermines key principles like zero trust, least privilege, and just-in-time access, leaving the organization vulnerable to future consequences.

As professionals, it is our responsibility to ensure senior leadership understands the risks of relying on temporary workarounds. Addressing technical debts and maintaining a strong infrastructure are critical to securing long-term operational integrity and avoiding costly security failures.