Resolving incorrect correlations by Unlinking Devices/Users
The Axonius Correlation Engine has evolved over time. However, footprints of older versions may still remain in customers' environments. If you encounter a device or user that seems to incorporate entities that don't belong together, “unlinking” may resolve the issue.
By clicking "Unlink Devices", you can unlink and break the different device adapter sources into several separate devices, with each individual entry referring to data received from a single adapter. For example, if a device has been correlated from three different adapters, unlinking that device will result in three different unlinked devices.
It's important to know that any manually unlinked devices may be relinked after the next discovery cycle or data fetch from a specific adapter connection, if the correlation logic determines to do so.
"Link Devices/Users" is the opposite action. It manually correlates at least two device records and consolidates their details into a single device. Unlike "Unlink Device/User", this action cannot be reverted and will not be overridden by the next correlation. Hence, it is not recommended to do it without consulting with Axonius experts.
>>How to Unlink devices?
For example, if you suspect the following device is incorrect (e.g. the two adapters' entities shouldn't belong together):
The steps to be done are:
1. Check the checkbox next to the relevant device/user:
2. Click on "Actions" and then on "Unlink Devices"
3. The following note will be displayed:
4. Now each of the device entities will be unlinked into separate devices.
- After the next discovery cycle completes, three outcomes may occur, depending on their properties and the correlation logic:
- The unlinked devices may be correlated as one device
- The unlinked devices may correlate with other devices
- The unlinked devices may remain as is
* We warmly recommend consulting with Axonius Customer Support or your Technical Account Manager before unlinking devices and especially when linking devices.
** The process described above is the same for User assets. Start from the Users tab instead and replace "Devices" with "Users".