Prevention of asset growth deviations

After you confirm that the reported asset growth is legitimate, there are several ways to prevent IBM® QRadar® from triggering growth deviation messages for that asset.

Use the following list to help you decide how to prevent asset growth deviations:

• Understand how QRadar handles stale asset data.
• Create identity exclusion searches to exclude certain events from providing asset updates.
• Tune the Asset Reconciliation Exclusion rules to refine the definition of deviating asset growth.
• Create asset allowlists to prevent data from reappearing on the asset blocklists.
• Modify the entries on the asset blocklists and asset allowlists.
• Ensure that your DSMs are up to date. QRadar provides a weekly automatic update that might contain DSM updates and corrections to parsing issues.