Symantec Privileged Access Management

  • 1.  Device Discovery Purge Interval

    Broadcom Employee
    Posted Aug 09, 2018 04:33 AM

    A client is trying to configure regularly scheduled device discovery scans for the purpose of manually importing / managing devices on a given subnet/mask network. 

     

    The client is concerned about the Device Scan -> Purge Interval setting and the effects of this setting on the PAM system.

     

    The online documentation states 

     

    "

    Purge Interval sets the number of days after which devices that are discovered by this scan are deleted, if not also discovered by another profile.

    "

     

    What is not clear is whether this means that devices (previously discovered and 'managed') which are no longer on-line and cannot be 're-discovered' (due to permanent decommission or temporary outage) are automatically deleted from PAM as a 'Managed Device' - after the purge interval.

     

    ..or to state the client's question "I'm a little concerned about the purge timer because the documentation says devices not scanned within the purge time frame are deleted. That could create a problem if a system is offline or otherwise inaccessible for a couple of scan cycles. What happens if we just run one scan and never scan anything again. Would everything we scanned be deleted after 30 days?"

     

    It was my understanding that

    a) Device discovery does not automatically add devices to PAM (unless automatically manage is checked) or remove devices that were at one time imported/managed via device discovery, even if they are not discoverable on subsequent scans.

     

    b) That the Device Discovery Profile Purge Interval setting does not refer to devices that were previously discovered and managed through device discovery, but rather to the discover/scan results.

     

    can you please clarify if my understanding is correct or expand on how this feature works.



  • 2.  Re: Device Discovery Purge Interval
    Best Answer

    Broadcom Employee
    Posted Aug 09, 2018 05:37 PM

    Yes, it does not apply to managed devices, that would be a bug.



  • 3.  Re: Device Discovery Purge Interval

    Broadcom Employee
    Posted Aug 13, 2018 04:06 AM

    Thank you.

     

    it may be worth explaining this nuance in our docops documentation.



  • 4.  Re: Device Discovery Purge Interval

    Broadcom Employee
    Posted Aug 13, 2018 10:14 AM

    Please add a comment to the documentation page where you find the information to get it updated. You may have to login using your support.ca.com account credentials to be able to comment on online doc pages.