SecurityInsight settings · Settings > Connectors & CMDB
Asset tagging
| Key | SI_AssetTagging_Enabled |
|---|---|
| Where | Settings > Connectors & CMDB > Asset tagging |
| Type | On / off |
| Default | Off: no tagging rule sets a tag anywhere and no report treats a device as excluded because of one |
| Edition | Community |
| Confirmation | SecurityInsight asks you to confirm before it is switched on. |
What it does
Turns asset tagging on: the asset-tagging rules (for example Auto-CanBeOnboarded--Excluded--SI for the devices Defender can onboard) apply inside SecurityInsight, and the tagging job may run.
When enabled
On, the asset-tagging rules you have switched on tag the CIs inside SecurityInsight, and a rule whose tag ends in --Excluded--SI takes the device out of every report. Writing the tags to Defender, Azure and Entra stays the separate 'Asset tagging writes tags' setting. Off, no tagging rule tags anything, the tagging job does not run, and a tag an earlier tagging run wrote is ignored; your own exclusion tags keep working.
When disabled
no tagging rule sets a tag anywhere and no report treats a device as excluded because of one
Risk and how to reverse it
The tagging rules you have switched on take devices out of every report (a tag ending in --Excluded--SI). A wrong rule hides many devices at once. Reversible: turn it off and the next CI build puts them back.
Requires
Nothing else.
Recommended
Off until you have decided which automatic exclusions you want; then on, and check the Excluded assets report.
Documented for SecurityInsight 3.0.79. Written by the SecurityInsight team; Invardia publishes it. · All settings · Security review pack