Assets Page

Use the Assets page to manage assets discovered in your environment. You can manage different types of resources as assets in your system just like you would any other asset. All your environment's resources are accessible from one place. This provides a new level of granularity for analyzing the attack surface. Using queries, critical assets can be prioritized and workflows can be made more efficient.

To open the Assets page, click the icon on the left navigation panel.

The Assets page consists of a selection pane on the left and a results table on the right. The selection pane has two tabs:

• Assets - View assets by type.
• Queries - View assets by query.

Viewing Assets by Type

On the Assets tab, assets are organized into categories, under which the various asset types are listed.

The asset categories are:

• Compute - Includes the following assets:

  • Devices
  • Vulnerabilities
  • Compute Services
  • Databases
  • Containers
  • Serverless Functions
  • Compute Images

• Identity - Includes the following assets:

  • Users
  • Groups
  • Roles
  • Accounts
  • Certificates
  • Permissions

• Applications - Includes the following assets:

  • Software
  • SaaS Applications
  • Application Extensions
  • User Extensions
  • Application Settings
  • Licenses
  • Expenses
  • Activites
  • Application Services
  • Application Resources

• Tickets - Includes tickets from applications like ServiceNow.

• Network - Includes the following assets:

  • Networks
  • Load Balancers
  • Network Services
  • Network Devices
  • Firewall Rules

• Storage - Includes the following assets:

  • Object Storage
  • File Systems
  • Disks

• Alerts & Incidents - Includes the following assets:

  • Alerts/Incidents

Select an asset type to see the inventory of assets in the relevant asset table to the right. The asset table changes to display data for the selected asset type. You can select one or more assets in the table and perform actions from the Actions list. Click on an individual asset in the results table to view more information in the Asset Profile Page.

Viewing Assets by Query

Use the Queries tab to select a recently run saved query and view the results in the table. The last 10 queries used are listed. This list includes any run query, whether saved or not. Unsaved queries appear in the list as Unsaved Query.

• Hover over a query and click the pin icon to pin the query. Pinned queries appear at the top of the Queries list under Pinned.
  
• Use the Search box to search the list of recently run queries.

Creating Queries

Use the Query Wizard to create granular queries to understand how assets adhere to their policies. The Query Wizard presents options appropriate to the selected asset type. You can define a wide variety of filters, from which you can easily drill down to the assets that match the required search criteria. Learn more about Creating Queries with the Query Wizard..

Viewing Query Results

The total number of assets collected for that query (or for all collected assets when no query is present) is displayed on the top left side of each table:

A number of columns are displayed for each asset. The columns displayed are determined by the asset type.

Expanding Asset Data

Click to expand the asset record and to display asset 'uncorrelated' data, i.e., the asset data per adapter. This functionality provides you with a single view and an easy way to identify the source for each of the different field values. Click again to collapse the asset data.

Hover over the Adapter Connections column to see the adapter name for all adapter connections in a tooltip. If you defined an Adapter Connection Label on the adapter connection configuration it will be concatenated to the adapter name value. This can help distinguish between two adapter connections from the same adapter.

Expanding Aggregated Field Data

There are two types of asset columns:

• Aggregated data fields - A common field which contains data fetched from different adapters. For example, Host name, MAC address, OS type, and many more.
• Specific data fields - A unique field which contains data fetched from a single adapter source. For example, "Region" field from Amazon Web Services (AWS).

Click in any generic data field to view a tooltip with the field's 'uncorrelated' data, i.e., device specific field data for that asset entity / adapter connection. Click to collapse the tooltip.

For example, if you expand the 'Last Seen' field, you can see when the device was seen by each of its source adapters. Mouse over the number of additional parameters to display a context menu showing the first 10 parameters in this field. You can scroll through the data. For fields with multiple values, you can click the copy icon to copy the values to the clipboard.

For list fields click View all results to open the data in the Asset Profile page, presented as a table.

Viewing Complex Fields on the Asset Profile Page

Complex fields are fields which can display a number of parameters. For instance, the Installed Software field can contain the Software Version field, the Software Name field, Software Vendor field and more.

In Complex fields, the system displays the first few parameters in the field, and then displays the number of additional parameters.

Mouse over the number of additional parameters to display a context menu showing the first 10 parameters in this field. You can scroll through the data.

Click View all results to open the data in the Asset Profile page, open at that complex field presented as a table.

Setting Page Columns Display

You can set the columns displayed on the page, and freeze specific columns so that they are not scrolled. The Adapter Connections column is frozen by default. Refer to Setting Page Columns Display.

Resizing Columns
You can also resize table columns. Columns that contain logos with text fields cannot be resized (for instance OS: Type in Devices or Used By in Applications Extensions).
To resize a column, hover over its header and drag the bar that appears to the right of the column to the required column width. Values that are not displayed when the column is narrower, are represented by a numeral.

Performing Actions on Assets

Select one or more Assets and use the options in the Actions menu to perform various actions. The available actions change depending on the type of asset. Refer to Asset Actions.

Displaying Historical Data

Axonius saves daily “snapshots” of all the collected data, which you can view for any query in the relevant assets page.

To view device query results for a specific date, click the calendar button or click Display by Date above the query results table.

A date picker control opens, enabling you to select the desired data. By default, the latest day for which data was collected is displayed.

Notice that only dates with collected data are enabled as options for choice.

To clear the historical view and set back to latest, hover over the displayed date and click on the 'X' next to the displayed date.

Navigating between Table Result Pages

By default, 20 results are displayed in each table page. You can change the number of results per page and choose between 20, 50 or 100, by clicking the appropriate icon on the bottom left side of the table:

Use the pagination bar at the bottom right side of the table to move between pages:

Cancel Query

Cancel Query is displayed when you run a query. Click Cancel Query to revert to the results of the last successful executed query.

Last Updated Indication and Refresh Query

When query caching is enabled and query results are retrieved from cache, the Last updated indication is displayed. This indication specifies the last time the query was executed and from when the displayed query results are updated.

Use Refresh Query to run the query again to recalculate the query results.

Exporting Asset Data to CSV

You can export the query results table data and its view (displayed columns) to a CSV file. Learn about Exporting Asset Data to CSV.