Expanding Assets by a Complex Field

Generally, each row in an Assets table represents an asset entity containing data from every adapter connection. However, you can choose instead to expand each row by data from a complex field that is most interesting to you, and explore assets in the context of this specific field.
Complex fields are fields that are made up of a number of different parameters (nested fields) and can be presented in a table view. For a detailed explanation on complex fields and how to view and manage them, see Asset Profile Page - Complex Fields.

Selecting a Complex Field to Expand Assets By

From the Assets page:

1. Click Edit Table, then select Expand Assets by.
   

2. Select a complex field from the dropdown list. You can only select one field at a time.
   The complex fields available for selection depend on the columns currently displayed in the table. You can only select a complex field that has at least one of its nested fields displayed in the table. In the example shown here, the Network Interfaces complex field is available for selection because two of its nested fields are displayed in the table: Network Interfaces: MAC and Network Interfaces: IPs.

3. If you want to expand assets by a different complex field, first you need to add one of its nested fields to the table by clicking Edit Table > Edit Columns. For example, if you want to expand assets by the Installed Software complex field, you can add, for instance, the Installed Software: Software Name field to the table.

For more information, see Adding or Removing Fields.

Exploring the Expanded Assets

In the following example, we expanded the Devices table by the Installed Software complex field. In the updated view, expanding each device’s row displays a list of all software installed on this device. For each row, the source adapter is displayed under the Adapter Connections column.

If there are more than 50 rows on the list, click View all X Results at the bottom of the 50th row to view the full list of results in the Asset Profile page.

This view lists all software installed on the device and their details, such as version, vendor, source, etc.

To go back to the original view, select Expand by > Adapter Connections (which is the default option) or click Reset.

Adding or Removing Fields

You can add to the table as many nested fields of the expanded complex field as you like, and the expanded view will update accordingly.
For example, if you add both the Installed Software: Software Name and Installed Software: Software Vendor fields, and select Expand assets by > Installed Software; in the updated view, each expanded row lists all software installed on the device and their vendors.

If you remove one of the nested fields, the table is still expanded by the same complex field and shows data from the remaining nested fields.
For example, if you remove the Installed Software: Software Name field from the above view, each expanded row still lists the software vendors.
If you remove all nested fields, the table goes back to its original view, and the option to expand assets by the complex field you selected is no longer available.

Filtering Expanded Asset Data

You can filter the data listed in the nested fields using the Query Wizard so that it only shows values that interest you.
In the following example, the Devices table is expanded by the Vulnerable Software complex field. Each row lists data regarding the vulnerabilities detected on each device, such as CVE ID, CVE Severity, Vulnerable Software Name, etc.

To filter data by, for example, devices that have Critical CVEs, run the following query. It is recommended to specify the filter under the Vulnerable Software complex object field to ensure proper data refinement. For more information, see Refining Expanded Asset Data.

Refining Expanded Asset Data

Running the query demonstrated in the previous section displays in each expanded row devices with critical CVEs in addition to other severities. To hide every other severity from view, click the Refine Data button next to the CVE Severity filter and select Refine value by condition.

Now, the Vulnerable Software: CVE Severity field is empty for each CVE whose severity is not Critical.

If you want to hide the empty values from view and show only devices with Critical CVEs, back in the Query Wizard, click the Refine Data button next to the Complex Field (OBJ) row and select Refine value by condition. This applies data refinement to all the nested fields that meet the criteria defined in the query.

Now, expanding each row shows only Critical CVEs:

While filtering and refining data from the Query Wizard is most recommended, you can also do it from the Refine Data Display dialog. Note that the complex field tab is automatically added to the dialog when you choose this option, and you can apply filters from there. For more information, see Refining the Data Displayed in Table Columns and Rows.

Sorting Expanded Asset Data

You can sort the data listed in the nested fields so that the rows will be displayed in an ascending or descending order. Hover over the sorting icon to the right of each column header to sort the data as you like.

Exporting Asset Data to CSV

An expanded view does not affect the functionality of exporting asset data to CSV or the structure of the CSV file. For complex fields and lists you can create a CSV file where the values of complex fields and lists are represented as separate rows in the file. Do this by selecting Split by field value in the Export Data dialog. For more information, see Exporting Asset Data to CSV.

Saved Views with Expanded Assets

You can save a view with a selected complex field to expand the assets by. Every time you apply this view from your Saved Views list, the assets will be expanded by this field by default.

For more information on saved views and how to create them, see Saved Views.

The option to expand assets by a complex field is displayed at the bottom of the New View dialog.

1. Click Expand Assets by.
2. A Select column dropdown appears. Select the complex field you want to expand assets by.

3. Remember that the complex fields available for selection depend on the columns currently displayed in the table. If you want to expand assets by a different complex field, you can add one of its nested fields within the New View dialog, and the Select column list updates accordingly - as demonstrated below.

4. Click Save.

Saved Queries with Expanded Assets

You can save a query with a selected complex field to expand the assets by. Every time you run this query, the assets are expanded by this field by default.

For more information on how to save queries, edit and manage them, see Saved Queries.

The fact that a query has expanded assets is indicated inside the Saved Query drawer. Refer to Viewing and Editing Query Details to learn more about this component.

In the following user query example, you can see that at the bottom of the query drawer that assets are expanded by the Associated Devices complex field. Note that this is possible due to the fact that the Associated Devices: Device Name nested field is included in the table, as listed under Query Column Display.