Asking Questions About Your Assets

Type your question in the input field the same way you would ask a colleague. You do not need to know AQL, field names, or which adapter the data came from.

A few examples of the kinds of questions you can ask:

• "How many Windows devices haven't been seen by any agent in the last 30 days?"
• "List all users with admin privileges who haven't logged in this month."
• "Which devices are running an end-of-life operating system?"
• "Show me all SaaS applications with a high-risk rating."
• "How many critical security findings are currently overdue?"

The agent interprets your question, determines the appropriate filters and asset type, and returns the results. For questions that return asset records, you will see a count and a table with links that open the corresponding records in Axonius.

Supported Asset Types

The AI Agent can query all major asset types in Axonius, including:

• Devices — laptops, servers, virtual machines, network devices, cloud instances, and more
• Users — directory accounts, SaaS user accounts, and identity records
• Software — installed applications and packages on managed devices
• SaaS Applications — applications discovered through SaaS adapters
• Security Findings — CVE matches, vulnerability scan results, and other security findings
• Vulnerabilities — aggregated CVE and exposure data

The agent also supports queries across other asset types configured in your environment. If you ask about an asset type and the agent cannot answer, it will tell you why — for example, if the relevant adapter is not connected.

How the Agent Translates Your Question

When you ask an asset question, the agent uses a natural-language-to-AQL tool to translate your intent into an Axonius Query Language (AQL) filter. It selects the correct asset type, identifies the relevant fields, and applies any conditions you described.

If your question is ambiguous — for example, if the same name matches multiple fields or if a specific value does not appear in the data — the agent will ask a clarifying question before running the query. Once the question is answered, it proceeds with the refined query.

The AQL filter itself is not shown in the chat. The agent presents the results in plain language and table form.

Refining a Result

After the agent returns a result, you can ask follow-up questions in the same conversation to refine or explore further:

• "Of those, which are exposed to the internet?"
• "Break that down by operating system."
• "Show me just the ones with a severity of Critical."
• "Which adapter reported those devices?"

The agent maintains the context of the current conversation, so it knows what "those" refers to from your previous question. You can keep refining through multiple turns until you have the answer you need.

If you want to save the underlying query the agent built, ask it: "Save this as a saved query called [name]." The agent will create the saved query in Axonius and confirm when it is done.