Manage discovery rules#
Manage discovery rules from the List of discovery rules.
To get to the list of discovery rules:
Enable or disable a rule#
A rule must be enabled for it to take effect.
Enable#
To enable a rule, do one of the following:
From the list of rules
From an open rule
Select a rule to open it, then select Enable.
Enable when creating rule
Select Enabled when creating a rule. See Create discovery rules.
Disable#
To disable a rule, do one of the following:
From the list of rules
From an open rule
Select a rule to open it, then select Disable.
Run rules#
Discovery rules run incrementally by default. This means that each time a discovery rule is run, it attempts to process all the objects ingested or created since the last time the rule was run.
The first time a rule is run, it is run against all objects on EclecticIQ Intelligence Center.
Note
By default, each run can discover up to 2500 entities. To change this, see “Tune discovery limits” in Update platform_settings.py.
Automatically run#
Rules run every 15 minutes while enabled (e.g. 09:00, 09:15, 09:30 …), and will run against all objects in EclecticIQ Intelligence Center that have been ingested or created since the last time it finished running.
Manual incremental run#
By default, manually running a discovery rule will execute an incremental run. This runs the rule against all objects ingested or created since the last time the rule was run.
Tip
To see the last time the rule finished running, select a rule to open it and go to the Logs tab.
To manually run rules:
Enable and run
When you enable a rule, a dialog box pops up asking if you want to run the rule now. Select Run now to run the rule now.
Select a rule to open it.
Select Enable.
In the dialog box that opens, select Run now.
Run now
You can run a rule using the Run now option.
Select a rule to open it.
Select Run now.
Alternatively:
Manually run on all objects
You can ignore the default behavior of discovery rules and run it on all objects, disregarding ingestion or creation time.
To manually run a discovery rule on all objects, use Save and re-run for all time.
Edit rules#
To edit a rule, do one of the following:
From the list of rules
From an open rule
Do one of the following:
Save and re-run for all time#
When you edit a rule, you can select Save and re-run for all time to:
Save your changes.
Run the rule on all existing entities, regardless of ingest or creation time.
Delete rules#
Caution
Deleting a rule is irreversible. You may want to disable a rule instead.
To delete a rule, do one of the following:
From the list of rules
From an open rule
Select a rule to open it, then select Delete.
Filter rules#
Filter by rule name
To filter by Rule name, enter an exact term (case-insensitive) to filter by in the Filter … field.
Filter menu
Select Filter to display the filter menu.
Here, you can filter rules by:
Category |
Description |
---|---|
Status |
Filter rules by whether they are Enabled or Disabled. |