Every asset in an IT infrastructure follows a lifecycle: it appears, operates and is eventually decommissioned. New assets are frequently created from existing templates yet quickly acquire unique characteristics. Constant infrastructure changes generate data anomalies including duplicates, erroneous merges and digital ghosts—assets that no longer exist but remain listed in the vulnerability management system.
To address these issues, Positive Technologies experts Kirill Maslov and Gamzat Shtanchaev describe three non-trivial tasks implemented in MaxPatrol VM: identification that matches data from disparate sources to a specific asset, correct merging of previous and new states, and maintenance of asset history that records the moment an asset disappears.
Assets in MaxPatrol VM are treated as frames on a film reel rather than real-time entities. The first frame records initial discovery via host discovery, hypervisor audit or directory service scan. Subsequent black-box scans reveal operating systems, open ports and services, while white-box audits provide users, groups, installed software and network interfaces. Specialized profiles such as PostgreSQL Audit further enrich data using transports including SSH, WMI and LDAP.
History appears as a timeline in the interface. Between scans, a data-aging mechanism uses policies that define freshness and obsolescence periods. A global 90-day threshold hides inactive assets from lists and vulnerability calculations while preserving them for historical PDQL queries. Assets are never permanently deleted.
Identification relies on type-specific key attributes. Network devices use hostname, IP and system ID; Windows systems add MAC address and FQDN; Linux systems use IP, hostname and MAC. Virtual machines prioritize VM ID. Scans must contain at least one valid key, with stricter requirements for full audits. Failed validation is logged with details of missing attributes.
Merging updates only attributes present in the new scan while leaving absent attributes unchanged. For nested objects the process recurses. An object is removed only when every source that previously supplied it has been executed and returned without it. Partial scanning profiles allow teams to collect vulnerability-relevant classes more frequently while running full audits less often.
Common ghost and duplicate scenarios include cloned machines retaining identical hostnames, virtual-machine clones that alter MAC and VM ID, and partial scans that leave stale collections intact. Recommended actions include enforcing unique hostnames after cloning and adjusting system IDs on virtual machines to prevent incorrect merging.
