Hi,

Lets say I have assets that I want to update manually and prevent Qradar from changing any information in those assets. Which is the best way to do that?

I would suggest investigating using searches for the Manage Identity Exclusion option (under Asset Profiler Configuration)  and how Asset Blacklists and Whitelists work. An option could be e.g. using rules to recognize targeted IPs and have an action to put them in the blacklist reference sets . As from my experience, containing unwanted behaviour when it comes to assets ends up to be more complicated than it looks.  If you are having trouble excluding them or anomalies on assets records due to constant refreshes by collected flows, it might also be worth tweaking a bit parameters under Asset Service Port Discovery : Asset Profile Reporting Interval & Asset Profiler Reporting Interval Counter (also in Asset Profiler Configuration).

------------------------------
Dusan VIDOVIC
------------------------------