Sorting and Ranking Results

Use natural language to ask for a sorted or ranked result set:

• "Show me the top 10 devices by highest CVE count."
• "Which 5 users have the most privileged accounts?"
• "List the 20 most recently discovered devices."
• "What are the devices with the lowest risk score?"
• "Show me the cloud instances with the highest number of open findings, sorted highest first."

The agent identifies the relevant sort field from your description, applies the sort on the server, and returns a table with the results in the order you requested.

Why Server-Side Sorting Matters

Results returned by the agent are limited to a fixed number of rows per response to keep the chat readable. If sorting were applied after the data was returned, the agent would only be ranking within that limited window — not across all matching assets in your environment. This would give you a misleading top-N list.

To avoid this, the agent applies the sort on the server before capping the result. This guarantees that when you ask for the "top 10," you are seeing the actual top 10 across all matching assets, not the top 10 from an arbitrary first page.

If the sort cannot be applied for a specific field, the agent will say so and will not present the results as a ranked list.

Result Format

Ranked results are returned as a table. The sorted field is included as a visible column so you can see the values that drove the ranking. The table also includes an Open in Assets link that opens the asset page in Axonius with the same filter and sort pre-applied, so you can explore the full dataset without losing the ranking order.

Supported Sort Fields

The agent can sort on any field available in the Axonius schema for the asset type you are querying — such as risk score, CVE count, last seen date, asset name, or adapter count. If you name a field that does not exist or is not applicable to the asset type, the agent will let you know and suggest alternatives.