I'm trying to tag assets that are live on the network. I run a Light Inventory Scan every night and have a vulnerability scan ran on only assets that were tagged with a tag I made called "Live Asset". The tag rule is Vuln(QID) Exist = 82023 which is titled "Open TCP Services List". I don't think that this particular tag rule is working since I performed an inventory scan on one of my sites and it returned 6 lives hosts but only 2 were tagged.
Is there a better solution to tagging live assets using different rules? I wish I could use multiple QIDs and say basically "IF QID 82023 OR 82040 exist on scanned asset, apply tag". What do you guys think is the best way of tagging live assets? I know I'm not the only one out here that has thought of this and I know I'm not the first person to ask on here. Surprisingly, I couldn't find a question related to this. Thanks everyone!