Allocation of ASUs at host level

[AntonioSousa]

If we have a certain amount of ASUs (Application Security Units), how can we tell Dynatrace to use them in certain hosts? We can control which processes are being monitored, but we seem to be unable to do it at a host level. Before putting in a Product Idea, can someone confirm?

[Julius_Loman]

@AntonioSousa , you can manage it only by using the security monitoring rules . You can also define it on a host level (monitor if host has some tag) or by MZ zone. The security rules are currently very limited, unfortunately. There is even no preview of the rules.

[AntonioSousa]

@Julius_Loman,

Yes, the security monitoring rules accepts a host tag, but the rules seem to be processed at the process level. My main issue is on how to say that I don't want to monitor a specific host? So, if a certain host has a certain tag ("equals"), does that mean that it applies to all processes running on that host, and that it is not monitored? And that that host does not consume ASUs?

[Julius_Loman · Accepted solution]

@AntonioSousa ASU consumption is triggered by AppSec monitored processes not by hosts, but it consumes the value of the host unit for each started hour a process is monitored. So if you don't have any appsec monitored processes running, you don't consume ASU. If you have appsec unsupported technology running, you don't consume ASU. If you have a supported process running and appsec rules evaluate to monitor it, it consumes the host unit value from the ASU. If you have multiple processes, the consumption happens just once for the host (not for each process).

Whole ASU licensing is quite a pain now as you don't have any visibility into how much is consumed, you can't preview the appsec rules or even see if a process is appsec monitored or not.