An Asset Inventory That Names Each Finding’s Owner

A finding on 10.20.3.7 is only half useful to a client with four infrastructure teams. Assets keeps each client’s inventory, with who owns each part of it, and pairs every finding with the asset its hosts belong to as the finding is shown. The pairing is never out of date, because it is never stored: change an owner and every finding follows.

Where it is

Assets is in the navigation, one inventory per client. It opens on every client with an inventory or with hosts to add, and a client’s own page and their risk register both open theirs. It is off until you turn it on: an administrator switches on Assets under Settings, Feature Modules.

Importing from discovery tools

Import from discovery tools reads several files at once and shows what it found before anything is written:

Cloud resources take their owner, team and environment from their tags or labels (Owner, Team, Environment and their common variants), and an instance’s Name tag becomes its name.

Ranges and wildcards own what falls under them

An asset can be a range, such as 10.20.0.0/16, or a wildcard, such as *.example.com. Its owner is the owner of every host under it, so one row says that a whole network belongs to the network team. A host with no owner of its own takes the owner of the narrowest range or wildcard it falls under, and the inventory shows where that owner came from.

Findings paired with their owners

Each host in a finding’s affected hosts is matched to an asset: the asset with that name, address or host name first, then the smallest range, then the longest domain. The finding’s page names the Owner under its affected hosts, and how many of its hosts are not in the inventory. The risk register shows each issue’s owners and filters by them, and the inventory shows each asset’s open findings by severity.

Hosts no asset covers

The inventory lists the hosts in a client’s findings that no asset covers, and Add them adds each as an asset in one step, marked as coming from findings.

Importing again

An asset already in the inventory is marked as seen now, and what the file adds about it (addresses, open ports, names) is added. Its owner, and anything else your team wrote, stays as it is, and is only filled in where it was empty. Not seen in 90 days counts the assets no import has reported for three months.

Owners for many at once, and CSV out

Tick assets and Set owner gives them an owner, a team, an email address or an environment together. CSV downloads the inventory with each asset’s addresses, open ports and open findings.

What the client sees

A client sees its own inventory in its portal, read only, while your firm shares the risk register with it. The database itself decides what each person can read, so a client is never given another client’s assets, and only your firm can change them.

An inventory the client recognises also makes the next scope easier to agree; see scoping a penetration test without guessing.