Tell me about the Unknown Device Report

The Unknown Device Report shows rogue devices that may have been placed on your network without authorization. When you run the Unknown Device Report, we compare the approved hosts list for the selected domain to saved map results. You may run this report as is with the default template settings or customize it for a different view.

1) Configure Approved Hosts for Your Domain

Go to VM/VMDR > Assets > Domains. Identify the domain you're interested in and select Edit from the Quick Actions menu. Click Configure next to Approved Hosts and then add hosts that you expect to see when you map the domain. Any host that is not in the approved hosts list will be considered rogue when you run the report.

2)  Run the Unknown Device Report

Go to VM/VMDR > Reports > Templates. Find the Unknown Device Report in the list and select Run from the Quick Actions menu. On the New Map Report page, provide report details (title and format), select the domain you want to report on and then choose one or two saved map results that you want to compare against the approved hosts list. Click Run.

3) Review the results

By default, only rogue hosts are listed in the report. A rogue host is any host that is not in the approved hosts list for the domain.

If the report template was edited so that approved hosts are also included in the report, then you can tell which hosts are approved and which hosts are rogue by looking at the Approved (A) column. If an "A" appears in this column, then the host is approved. If this column is blank, then the host is rogue.

What are the default template settings?

Title: Unknown Device Report

Display: Sort By IP Address

Selected Filters:

- Included Host Types: Rogue

- Included Discovery Methods: All discovery methods

- Included Status Levels: All status levels

- Included Operating Systems: All operating systems