Manage discovery rules#

Manage discovery rules from the List of discovery rules.

To get to the list of discovery rules:

From the left navigation, select Data configuration > Rules > Discovery.

Go to Data configuration > Rules > Discovery.#

Enable or disable a rule#

A rule must be enabled for it to take effect.

Enable#

To enable a rule, do one of the following:

From the list of rules

Locate the rule you want to enable.
Select More on the right of that rule.
Select Enable.

Enable a rule.#

From an open rule

Select a rule to open it, then select Enable.

Enable when creating rule

Select Enabled when creating a rule. See Create discovery rules.

Disable#

To disable a rule, do one of the following:

From the list of rules

Locate the rule you want to disable.
Select More on the right of that rule.
Select Disable.

From an open rule

Select a rule to open it, then select Disable.

Run rules#

Discovery rules run incrementally by default. This means that each time a discovery rule is run, it attempts to process all the objects ingested or created since the last time the rule was run.

The first time a rule is run, it is run against all objects on EclecticIQ Intelligence Center.

Note

By default, each run can discover up to 2500 entities. To change this, see “Tune discovery limits” in Update platform_settings.py.

Automatically run#

Rules run every 15 minutes while enabled (e.g. 09:00, 09:15, 09:30 …), and will run against all objects in EclecticIQ Intelligence Center that have been ingested or created since the last time it finished running.

Manual incremental run#

By default, manually running a discovery rule will execute an incremental run. This runs the rule against all objects ingested or created since the last time the rule was run.

Tip

To see the last time the rule finished running, select a rule to open it and go to the Logs tab.

Logs tab shows information on rule runs. — Logs tab show information on rule runs.#

To manually run rules:

Enable and run

When you enable a rule, a dialog box pops up asking if you want to run the rule now. Select Run now to run the rule now.

Select a rule to open it.
Select Enable.
In the dialog box that opens, select Run now.

Enable and run a rule.#

Run now

You can run a rule using the Run now option.

Select a rule to open it.
Select Run now.

Alternatively:

Select a rule to open it.
Select More > Run now.

Manually run on all objects

You can ignore the default behavior of discovery rules and run it on all objects, disregarding ingestion or creation time.

To manually run a discovery rule on all objects, use Save and re-run for all time.

Edit rules#

To edit a rule, do one of the following:

From the list of rules

Locate the rule you want to edit.
Select More on the right of that rule.
Select Edit.

From an open rule

Do one of the following:

Select Edit from the top right.
Select More > Edit from the top right.

Save and re-run for all time#

When you edit a rule, you can select Save and re-run for all time to:

Save your changes.
Run the rule on all existing entities, regardless of ingest or creation time.

Delete rules#

Caution

Deleting a rule is irreversible. You may want to disable a rule instead.

To delete a rule, do one of the following:

From the list of rules

Locate the rule you want to delete.
Select More on the right of that rule.
Select Delete.

From an open rule

Select a rule to open it, then select Delete.

Filter rules#

Filter by rule name

To filter by Rule name, enter an exact term (case-insensitive) to filter by in the Filter … field.

Filter menu

Select Filter to display the filter menu.

Here, you can filter rules by:

Category	Description
Status	Filter rules by whether they are Enabled or Disabled.