LogMan.io Assets configuration¶

LogMan.io Assets requires the following dependencies:

Apache ZooKeeper
Apache Kafka
MongoDB
SeaCat Auth
LogMan.io Library with /EventLanes/ (activity and complex lanes) and tenant schemas in /Schemas/
LogMan.io Watcher (optional, for per asset risk score weight lookups)

Model¶

Include the service in the site model and click Apply:

/Site/model.yaml

define:
  type: rc/model

services:
  lmio-assets:
    instances:
      <tenant>-1:
        node: <node>
        asab:
          config:
            tenant:
              name: <tenant>

Example¶

Minimal ASAB configuration:

[zookeeper]
servers=zookeeper-1:2181,zookeeper-2:2181,zookeeper-3:2181

[library]
providers=zk:///library

[kafka]
bootstrap_servers=kafka-1:9092,kafka-2:9092,kafka-3:9092

[asab:storage]
type=mongodb
mongodb_uri=mongodb://mongodb1,mongodb2,mongodb3/?replicaSet=rs0
mongodb_database=assets

[auth]
multitenancy=yes
public_keys_url=http://seacat-auth.service_id.asab/.well-known/jwks.json

[pipeline:ActivityAssetsPipeline:KafkaSource]
group.id=lmio_assets

[pipeline:ComplexAssetsPipeline:KafkaSource]
group.id=lmio_assets

Topics are not hardcoded in INI: on Library ready, the service discovers each tenant activity.yaml and complex.yaml and subscribes to their Kafka event topics.

Activity messages are produced by LogMan.io Parsec IndicatorOfActivityProcessor (principal host.id / user.id, auxiliary related.*, observer.name, observer.type). Principal field names and identity resolution come from /Schemas/Mappings/Asset_<schema>.yaml merged with parsec.asset on each Parsec event lane. See Parsec asset management.

`[assets]` section¶

Key	Default	Description
`mongo_collection`	`assets`	Mongo collection for asset rows
`mongo_tags_collection`	`asset_tags`	Tag sidecar collection
`mongo_suppress_collection`	`asset_suppress`	Shared merge/delete suppress (multi-instance)
`activity_mongo_batch_max`	`100`	Activity updates before `bulk_write`
`activity_mongo_batch_max_age`	`60`	Max seconds before partial activity flush (`0` = size only)
`complex_mongo_batch_max`	`100`	Risk score samples before Mongo flush
`complex_mongo_batch_max_age`	`60`	Max seconds before partial risk flush
`default_alert_after_sec`	`7200` (`2h`)	`alert_after` on first activity insert (`0` = disabled)
`risk_score_decay_half_life`	`24h`	Entity risk half life (see Entity risk score)
`risk_score_decay_clear_below`	`0.5`	Clear decayed scores below this
`risk_score_cas_retries`	`8`	Optimistic concurrency retries for risk score merge
`deleted_activity_suppress_ttl`	`600`	Ignore Kafka upserts after HTTP delete (`0` = off); Mongo TTL
`stale_alert_cooldown_sec`	`900`	Min seconds between repeat stale asset signals

Library skip (`/Assets/Skip/`)¶

Filter host and user assets (activity and complex). Matching is case-insensitive (except min_hyphens, which counts - characters).

Key	Match
`names` / `exact`	Full string
`prefixes`	Starts with
`suffixes`	Ends with (postfix)
`contains`	Substring
`min_hyphens`	Title contains at least this many `-` characters (`0` = off)

define:
  type: assets/skip

host:
  names:
    - localhost
  prefixes:
    - temp-
  contains:
    - "-dhcp-"

user:
  names:
    - SYSTEM
    - LOCAL SERVICE
  prefixes:
    - "urn:"
    - "NT AUTHORITY\\"
  suffixes:
    - "$"
  contains:
    - svc_
  min_hyphens: 4

Common Library defaults include user urn: prefix and min_hyphens: 4.

To drop the same patterns before they reach the activity Kafka topic, configure Parsec event lane parsec.asset.skip (see Parsec asset management). Parsec skip does not support min_hyphens.

New-asset notifications (instant + scheduled)¶

LogMan.io Assets can emit asab-iris notifications (same JSON Kafka path as lmio-alerts) for assets discovered from the activity stream. Routine last_seen updates do not notify. Creates that only come from the complex / risk-score path are not covered.

Instant: when an asset document is first inserted (Mongo upserted_ids).
Scheduled digest: ZooKeeper leader only; per (tenant, channel) tracker window. When INI period expires, one summary lists assets with first_seen after the tracker offset.

`[notifications]` section¶

Key	Default	Description
`topic`	`notifications`	Kafka topic for asab-iris JSON messages
`enabled`	`yes`	Master switch; `no` disables all new-asset notifications
`tracker_collection`	`notification_trackers`	Mongo collection for scheduled digest offsets
`digest_max_assets`	`50`	Max asset rows in digest template `new_assets` (full count is always in `new_assets_count`)

Channel INI (opt-in)¶

Add a section per channel you want to use (same pattern as Alerts). Without the section, that channel never sends. Optional period (default 3600 / 1h) controls the digest interval:

[notification:email]
from=noreply@example.com
to=soc@example.com
period=1h

[notification:slack]
period=3600

[notification:sms]
phone=+420000000000

[notification:push]
topic=assets

Library settings¶

Per tenant, place YAML under /Assets/Notifications/ (for example settings.yaml) with define.type: assets/notifications:

instant: enables one-shot messages for that channel
scheduled: enables periodic digests for that channel
optional channel-level schedule: silence windows (at cron, duration, action: delay|discard), same as lmio-alerts
optional params / exclude inside instant / scheduled (attribute / op / value, ops eq / gt / gte / lt / lte)

define:
  type: assets/notifications

email:
  instant:
    params:
      template: /Templates/Email/Asset Created.md
    exclude:
      - attribute: type
        op: eq
        value: user

  scheduled:
    params:
      template: /Templates/Email/Asset Summary.md
    exclude:
      - attribute: type
        op: eq
        value: user

  schedule:
    - at: "0 16 * * *"
      duration: 14h
      action: delay

slack:
  scheduled: {}

Default template paths (deploy separately in the Library):

Instant: /Templates/{Email,Slack,SMS,Push}/Asset Created.md
Scheduled: /Templates/{Email,Slack,SMS,Push}/Asset Summary.md

Instant params: tenant, asset_id, type, title, first_seen / last_seen (ISO UTC), name, description.

Scheduled params: tenant, name, description, new_assets_count, new_assets (list of {asset_id, type, title, first_seen}).

HTTP API¶

The service listens on tcp/8965 by default. Asset list responses include decayed risk_score, first_seen, last_seen, and computed active. Sort by entity risk with query parameter srisk_score.

Optional per asset risk score weight overrides are managed from the asset detail UI (and via HTTP API for automation). See Entity risk score.