Cisco Cyber Vision New UI Administration Guide, Release 5.6.0

Asset groups

Updated: July 6, 2026

Want to summarize with AI?

Explains asset groups as the segmentation identity model, including interface-based membership, custom and network groups, global and local scope, SGT precedence, and fallback behavior.

Asset groups are the segmentation identities that Cyber Vision uses to evaluate policy. When an asset interface belongs to an asset group, that group determines the SGT for the interface and the rules that can apply to its traffic.

Cyber Vision includes an asset group for a switch only after it has seen at least one asset interface from that group in traffic related to that switch.

When Cyber Vision has seen interfaces from two asset groups on the same switch, it can evaluate rules between those groups for that switch. The two groups do not need to have communicated directly with each other on that switch.

If Cyber Vision has not seen any interface from an asset group on a switch, Cyber Vision excludes that group from that switch. Rules that involve that group are not evaluated for that switch.

Group membership is based on asset interfaces, not an asset. One asset can have multiple IP addresses, and different interfaces of the same asset can belong to different groups.

Global and local group behavior

Use this table to distinguish asset group families.

Table 1. Asset group families
Group family	Source of membership	Segmentation role
Custom asset group	User-created or recommendation-derived membership from observed asset interfaces.	Explicit segmentation identity with an SGT. The group can be global or local.
Network group	Subnet-backed membership from Cyber Vision network definitions.	Fallback segmentation identity when an interface has no effective custom group.

Global groups are the default and preferred model for shared segmentation intent. A global assignment follows the interface wherever that interface is observed.

Local groups are switch-scoped. They are visible only on the switch where they are defined and override global membership on that switch. The local SGT replaces the policy context; it does not add another permission layer on top of the global group.

An observed interface can have only one effective SGT on a switch. Cyber Vision resolves identity in this order:

Table 2. Effective identity precedence
Order	Effective identity
1	Local custom group on the selected switch.
2	Global custom group assigned to the observed interface.
3	Network group fallback for the network that contains the interface.

Use this fallback behavior to predict what happens when local or custom group membership changes.

Table 3. Fallback behavior
Situation	Effective behavior
An interface is assigned to a local custom group on the selected switch.	The local group is the effective identity on that switch, even if the interface also has a global group.
An interface has no local custom group but has a global custom group.	The global group is the effective identity.
An interface has no effective custom group.	The network group for the interface network is the fallback identity.
A local group is deleted.	Former member interfaces fall back to a global custom group when one exists. Otherwise, they fall back to the network group for their network.

Create a global asset group

Use a global asset group when the same segmentation identity should apply to selected asset interfaces wherever Cyber Vision observes them.

Caution

Adding an asset interface to a group can change the segmentation identity and permissions that apply to that interface.

Before you begin

Identify the observed asset interfaces that should share the group.

Procedure

From the main menu, choose Segmentation.
Select the Groups dashlet.
Select Asset groups, select Custom groups, and then select Add.
Enter a unique name in Name.
Enter a description in Description, if needed.
Optional: Select a value from the Parent group drop-down list to filter the interfaces that belong to the selected network group.
Find and select the asset interfaces to add to the group from the list of Available assets.

You can search or filter by Network, Asset group, Asset type, or Vendor. Review Current group before you select an asset interface.
Select Create.

A new global asset group is added in Cyber Vision Center. The group can be used by rules, recommendations, and simulation wherever Cyber Vision observes its member interfaces.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.