This report outlines the mechanisms for managing asset lifecycles within the Phoenix Security platform, from automated garbage collection to manual scanner overrides.

1. Automated Lifecycle Management

The primary method for maintaining platform hygiene is through Lifecycle Configurations. This allows for separate, automated logic for findings versus the assets themselves.

1.1 Accessing Configuration

To configure these settings, you must have Organization Admin or Security Admin privileges:

1. Navigate to Settings > Organization Settings on the sidebar.
2. Select the Configuration tab.
3. Scroll to the Lifecycle Configurations section.

1.2 Finding vs. Asset Lifecycles

You can manage these two categories independently to balance data accuracy with security:

• Scanner Findings: Automatically closes vulnerabilities if their parent assets haven’t been reported for a set time. Because this is less destructive, you can set a shorter grace period to keep your dashboard current.
• Scanner Assets: Automatically purges (deletes) the asset entirely. Because this is a permanent action, a longer grace period is recommended.

1.3 The Grace Period & Exceptions

• Calculation: The grace period is measured from the date of the last full successful fetch (the days between the asset’s “last seen” date and the last successful fetch).
• Exceptions: Assets will not be purged if they originate from disabled scanner targets or if they have open issue tickets associated with them.

2. Managing Scanner Targets & Integrations

When scanners change or targets disappear, specific manual or automated actions are required.

2.1 Deleting Missing Targets

A “missing target” occurs when a target previously reported by a scanner is no longer found (e.g. it was removed from the scanner’s scope or is unreachable).

• Manual Deletion: These are not removed by standard Lifecycle Management. You must click the bin icon next to the specific target or select Delete ALL Missing Targets.
• Automated Deletion: At the bottom of the Scanner Targets table, you can enable a setting to automatically delete missing targets after a custom number of days.

2.2 Bulk Deletion via Integration Removal

If you need to wipe all data associated with a specific tool, deleting the Scanner Integration entirely will permanently remove all associated assets and vulnerability history.

3. Asset Imports: New/Merge vs. Delta

When uploading reports via the REST API or Multi-Scanner Import Tool, the import type determines how existing data is treated:

• New/Merge: The platform treats the new report as the “source of truth.” Any asset or vulnerability not in the new report is assumed to be resolved and will be automatically closed.
• Delta: The platform only adds or updates information. It will not remove or alter assets/vulnerabilities missing from the report.

4. Best Practices & Recommendations

Please be cautious, asset deletion is a permanent action that removes significant historical vulnerability data.

4.1 Recommended Grace Periods & Usecases

We recommend a tiered approach to grace periods. In general, you should be strict with findings and scanner targets to keep data fresh, while remaining more lenient with physical or virtual infrastructure assets to prevent accidental data loss.

• Stale Vulnerabilities (Findings): Delete or close frequently (2-5 days). Keeping findings up-to-date is non-destructive and ensures your remediation focus is on active risks.
• Scanner Targets: Set to 2 days. If a target is no longer in your scanner, it should be removed from the platform quickly to maintain synchronisation.
• Cloud & Container Assets: Delete more frequently (2 days).
  • Ephemeral environments create high vulnerability clutter. A short finding and target lifecycle keeps container tracking intact while clearing noise from inactive or destroyed containers.
• Infrastructure Assets (e.g. laptops): Apply a more graceful window (5-30 days) for asset purging, paired with a shorter window (2–5 days) for findings.
  • Devices that go offline for extended periods (vacations, maintenance) shouldn’t be purged from asset tracking. A shorter findings lifecycle suppresses vulnerability noise during downtime while preserving long-term asset visibility.

Always verify that your scanner fetches are running successfully before shortening grace periods, as a failed fetch could inadvertently trigger a mass purge of “stale” assets.