SG-Tanium - Server updated by multiple Tanium assets
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎05-22-2025 05:53 AM
Hello,
We have some VMs that gets rebuilt with the same name but different specs.
Tanium discovers them and creates one asset for each.
This leads to multiple assets with same name in the Tanium View
Example :
"vm1" last seen in Jan 25 with 8GB ram
"vm1" last seen in Feb 25 with 16GB ram
"vm1" last seen today with 32GB ram
The issue is that the SGC is updating only one server record: "vm1" (three times per import).
This is because of the IRE Hardware Rule, it will always match on the name.
Annoyingly, we do not know in advance which will be the last version applied (due to concurrent import sets)
So we can end up with the "vm1" server record with the ram from Jan 25
Expected behavior : "vm1" record gets updated from the most recent Tanium asset only.
Has anyone already encountered this ?
Do you have any idea how to handle this use case ?
Regards,
- Labels:
-
Service Graph Connector