Rule matching criteria
A security posture check task can be scheduled for multiple devices within one container.
However, each device can only match with one activated security posture check rule. To
determine the applicable rule for a device in a security posture check task, the system
evaluates the following attributes in order.
- Catalog information in asset properties
- Device name in FactoryTalk Linx
- Hardware type in asset properties
If no matching information is found, the system applies the default rule.
TIP:
For the same device, the hardware type and catalog information may differ depending
on the context in which they are displayed. For example, for a 1769-L27ERM device,
the hardware type in the asset properties may show as 1769-L27ERM-QBFC1B, while the
catalog listed in the task properties of a security posture check task may show as
1769-L27ERM-QxC1B. This difference occurs because different operations retrieve data
from different sources. When matching a device to a rule, the security posture check
task follows the evaluation order described earlier. The catalog in the task
properties represents the best match based on that evaluation order.
Depending on how you configure the information of your devices in rule settings, the rule
matching results and scanned results may vary for devices of the same type. The security
posture check supports exact and fuzzy matching, based on the use of a wildcard (*). The
wildcard can replace part of the product string in a fuzzy matching. In addition, you
can include double quotation marks ("") in a product string to refine matching
accuracy.
- Exact matching: The product string is fully specified without any wildcard (*). For example, 1756-L84ES.
- Fuzzy matching: The product string includes one or more wildcards (*). For example, 1756-L8* or 1756-*8*S.
When multiple activated rules are applicable, the highest priority rule will be selected.
The priority follows these principles, using 1756-L84ES as an example:
- Exact matching always has a higher priority than fuzzy matching.
- If a product string includes "", it has higher priority than one that does not.Example:
- Exact matching: 1756-L84E"S" > 1756-L84ES
- Fuzzy matching: 1756-"L84E"* > 1756-L*S
- For product strings that include "" in a fuzzy matching, the number of characters and the format of "" in this product string impact the priority.
- If "" are paired, the system applies fuzzy matching rules that do not include "".
- When the number of characters is the same:
- If there is one *, priority increases based on the number of characters to the left of the first *.Example: 1756-"L84"* > 1756-"L8"*"S"
- If there are multiple * and the number of characters to the left of the first * is the same, priority increases based on the number of characters to the right of the last *.Example: 1756-"L8"*"S" > 1756-"L8*E"*
- When the number of characters is different, the more characters, the higher the priority.Example: 1756-"L84E"* > 1756-"L84"*
- If "" are unpaired, the last " is treated as a character, preventing a match.Example: 1756-"L84E"*" cannot match with 1756-L84ES
- For product strings that do not include "" in a fuzzy matching, the number of characters and * in this product string impacts the priority.
- When the number of characters is the same:
- If there is one *, priority increases based on the number of characters to the left of the first *.Example: 1756-L*S > 1756-*ES
- If there are multiple * and the number of characters to the left of the first * is the same, priority increases based on the number of characters to the right of the last *.Example: 1756-*ES > 1756-*8*S.
- When the number of characters is different, the more characters, the higher the priority.Example: 1756-*8*S > 1756-L*
- The default rule has the lowest priority.Example: 1756 > Default
In summary, for a 1756-L84ES controller, a rule matching priority can be as follows:
1756-L84E"S" > 1756-L84ES > 1756-"L84E"* > 1756-"L84"* > 1756-"L8"*"S" > 1756-"L8*E"* >
1756-L*S > 1756-*ES > 1756-*8*S > 1756-L* > 1756 > Default.
Provide Feedback