Resolving incorrect correlations by Unlinking Devices/Users

The Axonius Correlation Engine has evolved over time. However, footprints of older versions may still remain in customers' environments. If you encounter a device or user that seems to incorporate entities that don't belong together, unlinking may resolve the issue.

By clicking Unlink Devices you can unlink and break the different device adapter sources into several separate devices, with each individual entry referring to data received from a single adapter. For example, if a device has been correlated from three different adapters, unlinking that device will result in three different unlinked devices.

It's important to know that any manually unlinked devices may be relinked after the next discovery cycle or data fetch from a specific adapter connection, if the correlation logic determines to do so.

Link Devices/Users is the opposite action. It manually correlates at least two device records and consolidates their details into a single device. Unlike Unlink Device/User, this action cannot be reverted and will not be overridden by the next correlation. Hence, it is not recommended to perform this action without consulting with Axonius experts.

How to Unlink devices

For example, if you suspect the following device is incorrect (e.g. the two adapters' entities shouldn't belong together):

The steps to be done are:

1. Check the checkbox next to the relevant device/user:

2. Click on Actions and then on Unlink Devices

3. The following note will be displayed:

4. Now each of the device entities will be unlinked into separate devices. 

5. After the next discovery cycle completes, three outcomes may occur, depending on their properties and the correlation logic:

1. The unlinked devices may be correlated as one device
2. The unlinked devices may correlate with other devices
3. The unlinked devices may remain as is 

Notes

We recommend consulting with Axonius Customer Support or your Technical Account Manager before unlinking devices and especially when linking devices.

The process described above is the same for User assets. Start from the Users tab instead and replace "Devices" with "Users".