Default Group: Overview

Summary: High-level overview of the Default Group in Ivanti Neurons.

The Default Group is a special group within Ivanti Neurons. It is a temporary repository for uploaded scan results related to assets and their vulnerabilities not already assigned to user-defined groups. While the Default Group cannot be deleted or renamed, it does offer the same user access controls as all other groups.

The Default Group works in conjunction with Ivanti Neurons Networks to manage the aggregation of vulnerability and asset fingerprint data during data ingestion. The network specified during the ingestion process determines asset uniqueness and the aggregation point (host names or IP addresses). If an asset’s aggregation point (host name or IP address, depending on the network) exactly matches an existing asset within that same Network, the Ivanti Neurons platform correlates the newly uploaded scan results to the asset no matter to which group(s) it belongs. If no matching IP address or host name is found within that same network, a new asset is created and assigned to the Default Group.

The Default Group can therefore be considered a “home for ungrouped assets”. Assigning these hosts or applications to their appropriate group or groups and removing them from the Default Group can then be performed from within the Manage > Hosts or Manage > Applications list views. Subsequent scan results uploaded into the same network are then automatically aggregated to the existing assets, no matter to which group(s) they belong.

Assigning assets to user-defined groups and removing them from the Default Group after uploading new scan results can aid in quickly identifying hosts and applications whose scan results have been uploaded into Ivanti Neurons for the first time. If there are no assets assigned to the Default Group before new scan data is uploaded, anything belonging to the Default Group after scan ingestion is complete would be an indicator of an asset that is new to the platform.

Auto-assignment of assets to groups using commonalities such as operating systems, IP ranges/subnets, or host name prefixes/suffixes is a very common use case of Playbooks.