Working with Resource Groups – Capsule8

Purpose

Console 4.8.0 introduces "Resource Groups", a powerful way to define reusable sets of machines. Previous console versions introduced limited functionality for selecting sensors: an individual policy set could declare metadata key/value pairs matching multiple sensors.

The Resource Grouping feature improves this functionality by:

Allowing multiple hostnames to be selected
Assigning a name to keep track of Resource Groups
Indicating which sensors match the selection criteria
Allowing the group to be re-used for future policy sets

These resource groups are dynamic; newly added sensors that meet the group's conditions will become part of the group without additional user interaction.

Prerequisites

Console 4.8.0
Logged in as a user with "Create Group" and "Edit Group" permissions
- By default, the Admin role and the Basic role have these permissions. Refer to Managing users in the Console for information about how to configure permissions.

Creating a Sensor Group

Navigate to Resources page, Groups tab. Click "Create Group":

Enter a name and a description. Click "Add Filter" next to "Conditions" and add at least one filter:

Click Save on the "Add Filter" popup.

Known Issue: As of Console 4.8.0, the Save button in the "Add Filter" popup may be obscured by the dropdown list. This is occuring in the above screenshot. Click in empty space to hide the dropdown and reveal the Save button.

The "Preview of Resources" table will update to show which resources meet the conditions:

The Resource Group is not yet saved.

Click Save in the top right to save the Resource Group and automatically return to the list of Resource Groups:

Viewing and Editing a Resource Group

Navigate to the Resources > Groups page.

Instead of clicking "Create Group", click an existing group. You'll be taken to the edit page for that group. Continue as per "Creating a Resource Group" above.

Deleting a Resource Group

Navigate to the Resources > Groups page.

Click the checkbox next to a group.

Click Delete.

Confirm in your browser's confirmation popup.

Apply a policy set to a Resource Group

Please refer to Deploy Detections from the Console.

Known Limitations

Only one group at a time may be deleted.
As of Console 4.8.0, the count of sensors in a group may incorrectly read "0 0".