04.02 Managing Assets in SimpleRisk

Why this matters

The asset inventory in SimpleRisk is the substrate the rest of the program reads from: risks reference assets, controls protect assets, compliance evidence describes asset management. The work in this article is the operational hygiene that keeps the substrate honest. You add assets when systems land in production, retire them when systems are decommissioned, group the ones that get treated together, and confirm the ones that arrived without a human looking at them.

That last point is why SimpleRisk splits assets into verified and unverified. An asset is unverified when someone who can't confirm it created it: a risk submitter typing an unfamiliar name into the Affected Assets field, an assessment respondent, a scanner import, or a discovery run started by a person without the verify permission. Someone who holds the verify permission reviews those and confirms the ones that belong. The split keeps the inventory from filling up with typos, duplicates, and one-off mentions that aren't real assets.

The third thing: asset groups are how you organize assets that get treated together. A "Production Database Cluster" group containing the individual server assets lets a single risk linked to the group affect all members, and adding a new server to the group later means existing risks linked to the group include it automatically.

All of this happens on one page. Inventory, verification, groups, and network discovery used to be spread across separate pages; they now live on Manage Assets, as two tabs.

Before you start

Have these in hand before opening the page:

The Allow Access to "Asset Management" Menu permission on your account. Without it, the Asset Management section is hidden from the sidebar entirely. That permission is enough to open the page and add assets. Everything else has its own permission, and the page shows only the actions you hold:
Able to Edit Assets to change an asset's fields.
Able to Delete Assets to delete assets, one at a time or in bulk.
Able to Verify Assets to verify assets, and to have the assets you create start out verified.
Able to Run Asset Discovery to start network discovery.
Able to Create Asset Groups, Able to Edit Asset Groups, and Able to Delete Asset Groups for the Asset Groups tab.
Allow Access to "Governance" Menu to choose the controls mapped to an asset while you add or edit it.

Anyone who could manage assets before an upgrade keeps all of these abilities until an administrator narrows them. See the Permission Reference. - A clear sense of what counts as an asset for your program. SimpleRisk's asset model is generic: anything that could be the subject of a risk or the target of a control can be an asset. Servers, applications, databases, network devices, cloud accounts, third-party services, physical locations, data stores. Pick the granularity that matches the risk-and-control work you're doing. - A naming convention. The asset name is what the rest of the program references. "DB-prod-east" next to "prod-east-db" next to "Production Database East" makes for a search experience nobody can navigate, and renaming hundreds of assets later is miserable. - A read on whether your install has the Encryption Extra active. When encryption is enabled, the asset name, IP, and details fields are encrypted at the database level. Anything reading the database directly sees ciphertext.

If your install uses team separation, you see and act on only the assets your teams can see. That applies to the lists, the bulk actions, the groups, and discovery results alike.

Step-by-step

1. Open the Manage Assets page

Sidebar: Asset Management → Manage Assets. The page has two tabs across the top, Assets and Asset Groups, each with a count. Bookmarks to the old Automated Discovery and Manage Asset Groups pages still work; they land you on this page (the second one on the Asset Groups tab).

The buttons that create things sit at the right end of that same row, and they change with the tab. On Assets you get Add asset, plus Discover assets if you can run discovery. On Asset Groups you get Add group. The row below the tabs holds only what shapes the table: the status filter, search, Filters, and Columns.

2. Find the assets you want

The Assets tab opens on All. Beside it are Verified and Unverified, each with a count, so the size of your verification backlog is always in view.

Search matches asset name or IP address.
Filters opens a row of dropdowns: team, site/location, tags, asset group, valuation, Confidentiality, Integrity, Availability, FIPS Categorization, and Weighted Band. Combine them freely: an asset has to pass every filter you set. Clear filters resets everything. You can also click a team, site/location, tag, or valuation shown in the table to add it to the matching filter, and the same goes for the rating, categorization, and band chips in the scoring columns; the list narrows to that value and the count on Filters goes up. A click only ever adds a value; take one out in the Filters row. The scoring filters offer Low, Moderate, and High, and Confidentiality also offers Not applicable. An asset that hasn't been scored never matches a categorization or band filter, and an asset whose confidentiality, integrity, or availability hasn't been rated never matches a filter on that rating.
Status pills. Click Verified or Unverified on a row and the list switches to that status, the same as choosing it in the status filter. Clicking the pill for the status already showing changes nothing; choose All to clear it.
Sharing a view. The address bar follows the page. The status, search, filters, sort order, page size, and page number are all in the URL, and the Asset Groups tab's search and filters are too, so you can bookmark a view or paste the link to a colleague and they see the same list. Column choices are yours alone and stay out of the link. Filters that name a team you can't see, or a rating a dropdown doesn't offer, are ignored.
Columns opens a searchable list of the fields you can show: asset name, IP address, asset valuation, site/location, team, asset details, tags, mapped controls, associated risks, creation date, and the six scoring columns. Out of the box the table shows asset name, status, asset valuation, FIPS Categorization, and Weighted Score, which fits a laptop screen without scrolling sideways. IP address and team are off by default; turn them on here, along with site/location, details, tags, or anything else. Search still matches IP addresses, and the Team filter still works, whether or not those columns are showing. If you saved your own column choice before, you keep exactly that choice: a new default never adds a column to a layout you've saved. When the Customization Extra is active, your custom fields for assets are listed there too. Asset Name and the verified status always stay visible. Your choice is saved to your account, so the table looks the same next time you open it.
Column order. Drag a column's header sideways to move it. The new order is saved to your account along with your column choice, so it's still there after a reload, a sort, or turning other columns on and off. The checkbox, Asset Name, and status columns on the left and the ⋯ column on the right stay where they are. Restore default layout, at the bottom of the Columns list, puts back the default columns in their default order. Moving columns needs a mouse or a touchpad; there's no keyboard way to do it yet, but the layout works the same whatever the order.
Scoring columns. The six Asset Scoring columns are Confidentiality, Integrity, Availability, FIPS Categorization, Weighted Score, and Weighted Band. FIPS Categorization and Weighted Score are on by default; turn the other four on in Columns, which doesn't change anyone else's table. Every scoring cell is a chip colored by level (Low teal, Moderate amber, High red, the same colors as the score bar). A Confidentiality of Not applicable is a plain gray chip that says so. The weighted score shows with two decimals, colored by the band it falls in. The score chip is the one scoring chip you can't click to filter, since a score is a number on a scale rather than a level; filter on Weighted Band instead. An asset that hasn't been scored shows — in the result columns, and an objective that hasn't been rated shows — in its own column. Sort by any of them and the unscored assets go to the bottom whichever direction you sort, so "highest weighted score first" puts the assets you've actually rated at the top.
The valuation cell shows both halves of a valuation level: its name, when your scale names the levels, above the range of values it covers, in your currency. Sorting by valuation orders the rows by that range, lowest first.
The row menu (⋯) stays pinned to the right edge of the table. With enough columns on, the table scrolls sideways under it, and the menu is still one click away.
Click a column header to sort. Not every column sorts. The ones assembled from several records at once, such as team or tags, don't.
The footer pages through the results and lets you change how many rows show at once.

Narrow the screen and each row becomes a stacked card, with the name and status on top.

3. Add an asset

Click Add asset at the right end of the tab row. A wide window opens over the list, titled Add asset, with the fields grouped into cards. The same window is used to view and edit assets (step 5), so what you learn here carries over.

If your organization has more than one asset template, a Template switch sits at the top of the window. Pick the layout that fits the asset you're adding before you start typing; switching after you've filled fields in asks whether to discard them.

Out of the box the cards and their fields are:

General
Asset Name is required and has to be unique. Case and spaces at either end don't make a new name, so "web01", "WEB01", and " web01" are all the same asset, and saving one of them when another exists is refused. The rule is the same whether or not the Encryption Extra is active. Follow your convention.
IP Address is optional. A single address, not a range. Leave it blank for cloud accounts and third-party services.
Asset Valuation is a dropdown of valuation levels. Configure the scale under Settings cog → Settings Hub → Preferences tile → Asset Management tab. It drives downstream risk-scoring math, so spend the time to set it honestly.
Assignment
Team holds the teams responsible for the asset. It drives visibility when team separation is on, and it routes notifications.
Classification
Site/Location is optional.
Scoring
Asset Scoring rates the asset's potential impact on confidentiality, integrity, and availability, and shows the results as you choose. It's optional; step 5 covers how it works.
Additional Information
Asset Details is rich text for purpose, owner, dependencies, and links to runbooks.
Mapped Controls links the asset to framework controls, one row per maturity level (see step 5).
Associated Risks links the asset to existing risks. Choosing them needs the Allow Access to "Risk Management" Menu permission, and only risks you can see are offered.
Tags are free-text labels for filtering and reporting, useful for cross-cutting groupings that don't merit a full asset group.
Custom Fields holds the Customization Extra's custom fields for assets, when there are any.

Your administrator can move fields between cards, resize them, and rearrange the cards, so your window may not match this list exactly. The fields are the same; only where they sit changes.

Choose Save asset. The window switches to the new asset in view mode, and the list behind it refreshes. Cancel closes the window without creating anything.

Whether the new asset starts out verified depends on you, not on which tab you were looking at. If you hold Able to Verify Assets, your assets are created verified, and the window shows a Verification card at the bottom with its Verified switch on. If you don't hold the permission, you won't see that card, and your asset is created unverified and waits for someone who does. An administrator can also switch on the preference Automatically verify new Assets created through the Asset Selector widget (Settings cog → Settings Hub → Preferences tile → Asset Management tab), which makes new assets verified regardless of who creates them.

4. Verify assets

Filter to Unverified, review the list, and confirm what belongs.

For one asset, open its ⋯ menu and choose Verify. The item appears only on unverified rows, and only if you hold the verify permission. If you've opened the asset to look at it first, the window's own ⋯ menu has the same Verify item, and Mark unverified on an asset that's already verified. Either one saves straight away, closes the window, and refreshes the list.
For many, tick the checkboxes and use Verify in the bar that replaces the toolbar (step 6).
While editing an asset, a verifier also sees the Verification card with its Verified switch. The change is saved with the rest of the form.

Deleting is the other half of the review. A typo or a duplicate doesn't need a verdict, it needs to go: choose Delete from the row menu, or select several and delete them together.

One rule catches people out. If you can't verify assets and you change the Asset Name or IP Address of an asset that's already verified, the asset goes back to unverified. A verifier confirmed a particular name at a particular address, and you've changed what was confirmed. Editing other fields such as tags, teams, or details doesn't change the status.

Working the unverified list is the cleanup discipline that keeps the inventory honest. When the backlog grows without anyone touching it, the inventory starts to drift.

5. View, edit, or delete one asset

Each row has a ⋯ menu. It lists View, Edit, Verify, Add to group…, and Delete, and leaves out whatever you lack the permission for. Clicking the asset name, or any part of the row that isn't a chip, checkbox, or button, does the same as View.

Viewing and editing happen in the same wide window you used to add an asset, over the list, so you never lose your place in a filtered view.

Viewing. The top of the window carries the asset's name, its number (Asset #1042, say), its valuation, and a Verified or Unverified pill. To the right are Edit asset (only if you hold Able to Edit Assets), a link button, and a ⋯ menu. The cards below show the values as plain text, with — for anything left empty. The footer notes the asset's standing and when it was added, as "Verified · added" followed by the date, or "Unverified: not yet confirmed by someone who can verify assets" and the same date. Close closes the window.

The window's ⋯ menu holds the actions you'd take on the asset rather than its fields, each shown only if you're allowed to use it: Add to group…, Verify or Mark unverified, View audit trail, and Delete asset. Add to group… and Delete asset close the window and open the same dialog the list uses.

Editing. Choose Edit asset (or Edit from the row menu). The cards turn into form fields, and the footer offers Cancel and Save asset. Saving takes you back to the view of the same asset with the new values, and the list refreshes behind it. Cancel leaves without saving and takes you back to where you started: to the view of the asset if you came in through Edit asset, or to the list if you chose Edit from the row menu or followed an edit link.

A few fields behave in ways worth knowing:

Mapped Controls is a set of rows. Each row pairs a control maturity level with the controls the asset holds at that maturity, picked from a searchable control picker. Add controls at another maturity adds a row; the remove button on a row drops that maturity's controls. Choosing controls needs the Allow Access to "Governance" Menu permission, because the picker reads the control catalog. Without it the field shows the existing mapping read-only (the count of controls at each maturity), and saving the rest of the form keeps the current mappings as they are.
Associated Risks needs the Allow Access to "Risk Management" Menu permission. With it, the field names the linked risks you can see and offers only those; under team separation, a risk outside your teams is neither shown nor offered, and saving keeps its link. Without it, the field shows only how many linked risks you could see (for example, 2 associated risk(s)), never which ones. There's nothing to pick when you add or edit the asset, and saving keeps every existing link.
Changing the Asset Name or IP Address of a verified asset when you can't verify assets returns it to unverified (see step 4).

Scoring the asset. The Scoring card holds two smaller cards side by side. On the right, Security Objectives asks the three questions that Federal Information Processing Standards Publication 199 (FIPS 199) asks about any system: how bad it would be if the information on this asset were disclosed (Confidentiality), modified or destroyed (Integrity), or unavailable (Availability). Each has a dropdown offering Not set, Low, Moderate, and High, and Confidentiality alone also offers Not applicable, for an asset whose information is public anyway. The small info icon after each label opens the rating guidance: the question, then what each level means (High is a severe or catastrophic adverse effect, Moderate a serious one, Low a limited one or none). Point at the icon or tab to it to open the guidance, and Enter toggles it. Esc closes the guidance and leaves the window open. In the Summary card, the Weighted Score, FIPS Categorization, and Weighted Band labels have info icons of their own: they explain what each result is and how it is worked out, including the thresholds your administrator has set for the bands. The same icons show when you view the asset, not only when you edit it.

On the left, Summary shows the results, and they update as you choose:

Weighted Score is a bar that runs from cool to hot, from the Low value on the left to the High value on the right (1.00 to 3.00 unless your administrator changed the values). The fill stops at the score, the score is printed above it, and two faint ticks mark where the Moderate and High bands start.
FIPS Categorization is the highest of the three ratings.
Weighted Band is Low, Moderate, or High, depending on where the weighted score falls.

All three results need all three answers. Until every objective is rated (Not applicable counts as an answer for Confidentiality), the bar stays empty, the two chips show —, and the card reads "Not scored — Answer all three objectives to score this asset." There are no partial scores. A new asset starts that way unless your administrator has set a default (see below), and so does every asset that was in the inventory before scoring arrived. "Not scored" isn't a rating of Low; it means nobody has rated the asset yet.

Rate C=Moderate, I=High, A=Low and you'll see the reason there are two results. The categorization is High, because one objective is High. The weighted score is 2.00 with the default settings (Moderate is worth 2, High 3, Low 1, and every objective counts equally, so the average is 6 ÷ 3), and 2.00 falls in the Moderate band. Both answers are right. The categorization is the worst case, the way FIPS 199 categorizes a system; the score blends the three, so you can tell an asset that's High on one objective from one that's High on all three. Data Classification and Asset Criticality goes into when each one is the number to use.

The scores are informational in this release. They don't feed risk scoring, and they don't change the asset's valuation.

In view mode the same two cards are read-only, with the three ratings listed as text and — for one that isn't set. On a narrow window, or wherever the card is too narrow to hold both side by side, Summary stacks on top of Security Objectives.

If your administrator has set Default scoring for new assets in Preferences, the Add asset form opens with those ratings already chosen. Change them or set them back to Not set before you save. The default applies only to that form. Editing an existing unscored asset doesn't pre-fill anything, and assets that come from discovery, an import, or the API stay unscored unless the import or the API request supplies ratings.

Saving sends only the ratings you changed. Editing an asset's tags, for instance, never rewrites its scoring, and each rating you do change is recorded in the asset's audit trail.

Changing one field from the view. For a quick fix you don't need the whole form. If you hold Able to Edit Assets, point at a field in the view, or tab to it, and a small pencil appears beside its value; on a touch screen the pencils are always showing. The pencil turns just that field into its control, with a cross to cancel and a check mark to save. Saving stores that one field, and the window and the list update in place. Enter saves a text field, and Esc cancels the field rather than closing the window. If a dropdown's list or the scoring guidance is open, Esc closes that first, and a second Esc cancels the field. The plain dropdowns (Asset Valuation and the three scoring ratings) are the browser's own, so how their open list reacts to Esc varies a little by browser, Firefox included; whatever happens, the Esc that closes the list never cancels the field.

Asset Name, IP Address, Asset Valuation, Site/Location, Team, Tags, Asset Details, Associated Risks (when you have Risk Management access), and Asset Scoring all work this way, and so do custom fields other than Long Text and Date ones. The Asset Scoring pencil opens the whole Scoring card, three dropdowns and the live Summary, and saving stores only the ratings you changed; setting one back to Not set clears it. Mapped Controls has no pencil; change it through Edit asset. Verification isn't a field here either: use Verify or Mark unverified in the window's ⋯ menu. The rules of the full form still apply. The name can't be left empty, emptying a field such as IP Address or Team clears it, and renaming a verified asset or changing its IP address without the verify permission returns it to unverified. The pill in the header changes the moment you save.

One field is open at a time. Choosing a second pencil, Edit asset, an action in the ⋯ menu, the close button, or the browser's Back button while the open field has changes brings up the same Discard your unsaved changes? question described below, and so does Esc.

If you close with changes you haven't saved, SimpleRisk checks first. Pressing Esc or clicking outside the window does nothing while there are unsaved changes, and the close button, Cancel, and the browser's Back button all replace the footer with Discard your unsaved changes? and two choices: Keep editing or Discard changes. Only real edits count. Opening the form and looking around doesn't trigger the question.

Audit trail. View audit trail in the ⋯ menu swaps the cards for the asset's history: date and time, the user, and what changed, newest first. The dropdown beside the heading switches the period between Past Week, Past Month, Past Quarter, and Past Year (the default). The list shows up to 500 entries. Back to asset returns to the cards.

Sharing a link to an asset. The window has its own address. Opening an asset adds ?asset={id} to the page's URL, editing adds &mode=edit, and adding a new asset uses ?asset=new. The link button in the header copies a link that opens the asset in view mode, and the address bar works the same way, so you can bookmark an asset or paste the link into a ticket. Whoever follows the link lands on Manage Assets with that asset's window open. Your filters and search stay in the address too, so closing the window leaves the list the way it was, and the browser's Back button closes the window or takes you from editing back to viewing.

A link never shows an asset to someone who shouldn't see it. If the asset has been deleted, or belongs to teams the person can't see, they get the message "This asset is not available. It may have been deleted, or you may not have access to it." and no window opens. The message is the same in both cases, so a link can't be used to find out whether an asset exists. An edit link opened by someone without Able to Edit Assets opens the asset in view mode instead.

Deleting. Deleting asks you to confirm first, and it can't be undone. Deleting also removes the asset's links: it drops off the risks it was associated with, the controls it was mapped to, and the asset groups it belonged to. Those risks, controls, and groups stay; they just no longer list the asset. If you want a softer alternative, rename a retired asset with a [RETIRED] prefix and take it out of active groups. That preserves the historical linkage.

6. Act on many assets at once

Tick the checkbox on any row, or the checkbox in the header to select the page. Once you've selected a page, a link offers Select all N assets, which extends the selection to everything matching your current search and filters, across pages. The toolbar is then replaced by a bar showing how many are selected, with these actions, each shown only if you hold the permission:

Verify confirms the selected assets.
Assign teams… adds the teams you choose to the selected assets. It adds; it never removes a team an asset already has. Under team separation you can pick only teams you belong to.
Add to group… adds the selected assets to an existing asset group. If you can create groups, the list ends with Create a new group…: pick it, type a New group name, and the new group is created holding the selection in one step.
Delete removes them after a confirmation dialog that states how many assets are affected.

One action covers at most 5,000 assets, or 2,000 when deleting. Past that, SimpleRisk asks you to narrow the selection before it does anything.

When the action finishes, you get a summary such as "12 verified, 2 skipped", with the reason for anything skipped: not found (which also covers an asset you can't reach) or failed. A large delete works in batches, so if one batch fails, the assets after it are reported as not attempted and left as they were. An asset you can't reach is skipped, not silently changed, and skipped rows don't stop the rest.

7. Manage asset groups

Click the Asset Groups tab. Out of the box the table shows each group's member count (Assets), then, if you can view risks, Linked risks, then Highest FIPS Categorization, Highest Weighted Score, Highest Weighted Band, and Highest valuation. That's the set that fits a 1280-pixel-wide window without scrolling sideways; the longer headers wrap onto two lines to make room.

The three "highest" columns roll the members' Asset Scoring up to the group, so you can see at a glance which groups hold your most sensitive systems:

Highest FIPS Categorization is the highest categorization among the members that have been scored. One High member makes the group High.
Highest Weighted Score is the highest weighted score among those members, with two decimals.
Highest Weighted Band is the band that highest score falls in, under the thresholds your administrator set.

Members that haven't been scored are left out of all three, and a group with no scored member, or no members at all, shows —. The two results can come from different members: a group holding one asset rated High/Low/Low and one rated Moderate across the board is High on categorization but has a highest score of 2.00, in the Moderate band. Like the member count, the results only count members you can see. If team separation hides some of a group's assets from you, their scoring never shows up in your view of the group. The chips use the same colors as on the Assets tab, and when an administrator changes the weights or band thresholds, the columns follow the next time the table loads.

Columns works the same way it does on the Assets tab, but the two tables keep separate choices, including the column order. You can drag its headers to reorder the columns too; the checkbox, the expand arrow, the name, and the ⋯ column stay put, and Restore default layout brings back the default set and order. Name is always on. You can add Teams, Site/Location, and Tags, none of which is on by default, and take off anything you don't want. Teams lists the teams of the group's members, and Site/Location and Tags list every distinct location and tag across the members, alphabetically, as chips that wrap and stop at three with a "+N" for the rest. If you saved a column choice for this table before these columns existed, you keep exactly that choice, Teams included.

Filters opens a row of dropdowns: Team, Site/Location, Tags, Highest FIPS Categorization, and Highest Weighted Band. A group matches a team, location, or tag when at least one of its members you can see carries it, and it matches a categorization or band when the group's own highest result is one you picked, so a group with nothing scored never matches those two. Set several and a group has to pass all of them. The count on Filters shows how many values are active, and Clear filters resets the filters and the search. Clicking a team, location, tag, categorization, or band chip in the table adds that value to the matching filter, just as on the Assets tab; the score chip is the exception, and so is the "+N". The search and the filters go into the address bar along with the tab, so a bookmark brings back the same filtered list. A filter value in a link that your dropdowns don't offer, such as a team you can't see, is dropped.

Click a column header to sort. Name, the three scoring columns, Site/Location (by each group's first location alphabetically), and Tags sort on the server, and groups with nothing in that column go to the bottom whichever direction you sort.

Click a row's arrow to expand it and see its members: name, valuation, verified status, and each member's own FIPS Categorization, Weighted Score, and Weighted Band. The drawer starts with the most valuable members first and breaks ties by name; click a header (or tab to it and press Enter) to sort by name, valuation, or one of the scoring results instead, and unscored members stay at the bottom. Each member has two buttons. View asset (the eye) opens the asset in the same window the Assets tab uses, with its own link; close it with Esc, the ×, or Back and you're back on the group with its members still showing. Remove from group takes the asset out of the group without deleting it. If a group has more members than fit, View all in the Assets tab jumps to the Assets tab already filtered to that group.

Deleting several groups at once. If you hold Able to Delete Asset Groups, the table has a checkbox on every row and one in the header for the whole page. Tick groups and a bar replaces the search row with the count, Delete, and, when more groups match than you've ticked, Select all N asset groups, which takes in every group matching your current search and filters, not just the page. As on the Assets tab, moving to another page, re-sorting, or changing the search or a filter clears the selection. Delete asks for confirmation, and the dialog says how many groups go and that their assets don't: only the groups are removed, the same as deleting them one at a time, and each one is recorded in the audit trail. When it's done you get a summary such as "3 groups deleted, 0 skipped". If someone else changed the matching groups between your Select all and the confirmation, nothing is deleted and SimpleRisk asks you to look at the list again. One delete covers at most 2,000 groups. Without the permission, there are no checkboxes.

To create a group:

Click Add group at the right end of the tab row, or the same button in the middle of the page when you have no groups yet.
Enter an Asset Group Name. Names must be unique, and case and spacing don't make a name different: "Web Servers", "web servers", and " Web Servers " are the same name. Extra spaces are collapsed and the ends trimmed before the name is saved.
Choose the assets. The picker searches by name or IP address and narrows the list by team, site/location, and valuation. Each option shows how many assets it would leave, and options with none are dimmed. Pick the assets and choose Use these assets.
Save.

Edit a group from its row menu the same way. A group is never compared with itself, so saving it under the name it already has always works, and so does changing only the capitalization of its name. Deleting a group asks for confirmation and removes only the group. The assets stay.

Membership is many-to-many. An asset can belong to several groups, and a group can hold any number of assets. If team separation hides some of a group's members from you, they stay in the group when you edit it; you just can't see or remove them.

Asset groups are linkable from risks and controls the same way individual assets are. When you link a risk to a group, reporting expands the group at read time, so the risk shows as affecting every current member.

8. Discover assets on your network

If you hold Able to Run Asset Discovery, a Discover assets button sits beside Add asset in the tab row. On a narrow screen it moves into the More actions menu, the ⋯ button next to Add asset. It scans a range of addresses in the background and adds the hosts that answer.

Click Discover assets.
Enter the range: a single IPv4 address, a start–end range, or an IPv4 CIDR block. The limit is 65,536 addresses per run. The Allowed ranges line under the field lists the networks your system administrator has opened to discovery, and the whole range has to fall inside them. Ranges that include loopback, link-local, multicast, or the 0.0.0.0/8 block are refused regardless, since a scan of those can't find real assets. If the dialog says discovery is not configured, no range is allowed yet and the start button stays off; that setting lives in the server's configuration file, so ask whoever administers the server.
Leave Look up host names on if you want new assets named after the host's DNS name. When a host has no usable name, its IP address becomes the name.
Optionally pick teams under Assign to teams. Every asset the run creates goes to those teams.
Read the Add new assets as line. It shows Verified if you can verify assets and Unverified if you can't. You can't change it here.
Check the Probe method line. It tells you how the server will look for hosts. If it says TCP connect, the server can't send ping, and the dialog offers TCP ports for this run; leave it blank for your administrator's default list.
Choose Start discovery.

The dialog closes and the run appears under Discovery runs, with its status (queued, running, completed, failed, or canceled), how many addresses it has checked, how many hosts answered, and how many new assets it created. The list refreshes itself while a run is active, and you get a message when it finishes. Cancel run stops one at its next progress checkpoint, not instantly. Assets that already exist, by address or by name, are skipped, so running the same range twice doesn't create duplicates.

A few things to know before you rely on it:

Discovery runs in the background, so it depends on the queue worker your administrator schedules through cron. If runs sit at queued and never start, that's the first thing to check. The Cron Jobs article covers it.
How the server probes depends on its privileges. With ICMP ping it finds hosts that answer a ping. With TCP connect it finds only hosts that accept or refuse a connection on one of the scanned ports, so a host that blocks all of them doesn't show up. Your administrator can change the server's setup; the System Requirements article explains the options.
You can have three runs going at once, and the whole install is capped at ten. Past either limit, the start button reports it and you wait for one to finish or cancel one.
A large range is worked in slices so it doesn't monopolize the queue. Expect a big range to take a while.
Discovery finds hosts that reply to its probe. It won't find machines that block it, and it tells you nothing about what the host is. Treat the results as a starting point for the unverified review, not a substitute for it.

9. Programmatic asset management via the v2 API

For automation (bulk import from a CMDB, scheduled sync from a cloud-provider inventory, integration with a scanner) the v2 API exposes the asset operations. Endpoints that change data need the same permission as the matching action on the page, held by the user the API key belongs to.

Asset CRUD:

GET /api/v2/assets lists assets (or pass ?id={id} to fetch one). It accepts the filters the page uses: verified status, a search string, team, site/location, tag, asset group, valuation, the two result filters, categorization and band (level ids: 1 Low, 2 Moderate, 3 High), and the three rating filters, confidentiality, integrity, and availability (the same ids, plus 0 for Not applicable on confidentiality only). It pages its results and can return just the columns you name, including the six scoring columns.
GET /api/v2/assets/{id} fetches one asset.
POST /api/v2/assets creates an asset. It comes out verified or unverified by the same rule as the page, and a caller who holds Able to Verify Assets can decide explicitly: verified set to 0 creates it unverified, set to 1 creates it verified. From anyone else the field is ignored. Send confidentiality, integrity, and availability to score it, each low, moderate, or high (not_applicable is also accepted for confidentiality). Leave them out and the asset is unscored; the API never applies the Preferences default.
PATCH /api/v2/assets/{id} updates an asset (needs Able to Edit Assets). The same three fields change the ratings, an empty value clears one, and a value the objective doesn't accept is refused with a 400 and nothing is saved. On an install whose database upgrade hasn't run yet, POST and PATCH requests that send any of the three are refused with a 503 and nothing is saved; requests without them work as usual.
On POST and PATCH, a body that sets or clears mapped controls also needs Allow Access to "Governance" Menu, the same as the window's control picker. Without it the request is refused with a 403 and nothing in it is saved, so a sync script run as a non-Governance user should leave mapped controls out entirely.
DELETE /api/v2/assets/{id} deletes an asset (needs Able to Delete Assets).
GET /api/v2/assets/{id}/audit-trail returns the asset's history, newest first, up to 500 entries. ?days= takes 7, 30, 90, or 365 (the default).

Bulk actions:

POST /api/v2/assets/bulk applies one action (verify, delete, assign teams, or add to a group) to a list of asset IDs or to everything matching a filter. It returns a result for each asset, so a partial failure is visible. The limit is 5,000 assets per call, or 2,000 for delete.

Column settings:

GET /api/v2/assets/column-settings and PUT /api/v2/assets/column-settings read and save the calling user's chosen columns and their order.

Discovery runs (need Able to Run Asset Discovery):

POST /api/v2/assets/discovery-runs starts a run from a range.
GET /api/v2/assets/discovery-runs lists runs, newest first, and GET /api/v2/assets/discovery-runs/{id} reads one.
DELETE /api/v2/assets/discovery-runs/{id} cancels a queued or running run.

Asset metadata and helpers:

GET /api/v2/assets/options fetches the dropdown options used by asset pickers.
GET /api/v2/assets/associations fetches the risk and compliance associations for assets.
GET /api/v2/assets/tags lists all asset tags.

Asset group CRUD:

GET /api/v2/asset-groups lists groups. Ask for aggregates to get each group's member count, highest valuation, teams, linked-risk count, sites/locations, tags, and highest FIPS categorization, weighted score, and weighted band in the same call, all worked out from the members you can see. It also accepts a search string, paging, the filters the tab uses (team, location, tag, categorization, and band; the last two take level ids, 1 Low, 2 Moderate, 3 High), and sort by name, one of the three scoring results, locations, or tags.
GET and PUT /api/v2/asset-groups/column-settings read and save your own column choice for the Asset Groups table, separately from the Assets tab's GET and PUT /api/v2/assets/column-settings.
POST /api/v2/asset-groups/bulk deletes many groups at once, by a list of IDs or by the same filters the list takes, and returns a result for each group (needs Able to Delete Asset Groups). Deleting by filter needs the number of groups you expect; if the match has changed, nothing is deleted. The limit is 2,000 groups per call.
POST /api/v2/asset-groups creates a group (needs Able to Create Asset Groups).
GET /api/v2/asset-groups/{id} fetches one group.
PATCH /api/v2/asset-groups/{id} renames a group or replaces its members (needs Able to Edit Asset Groups).
DELETE /api/v2/asset-groups/{id} deletes a group (needs Able to Delete Asset Groups).

Asset group membership:

GET /api/v2/asset-groups/{id}/assets lists the assets in a group. With paging, each member comes with its FIPS categorization, weighted score, and weighted band, and sort orders the members by name, valuation, or one of those results before the page is cut.
POST /api/v2/asset-groups/{id}/assets adds assets to a group (needs Able to Edit Asset Groups).
DELETE /api/v2/asset-groups/{id}/assets/{asset_id} removes one asset from a group (needs Able to Edit Asset Groups).

The CRUD endpoints are the building blocks for sync scripts. A typical pattern: fetch the upstream inventory, iterate the entries, and POST new ones, PATCH changed ones, and DELETE retired ones. Pair the script with the verification discipline. Run it under a user without the verify permission if you want everything it creates to wait for human review, or under one who holds it if you trust the upstream source. Request and response shapes are in the OpenAPI documentation.

Scores in spreadsheet imports and exports (needs the Import-Export Extra):

An Assets export ends with three extra columns, Confidentiality, Integrity, and Availability, after every other column, custom fields included. They hold the rating labels in your language (High, Moderate, Low, Not applicable), or nothing for an unrated objective. Because they come last, import mappings you saved before scoring arrived still line up with the columns they were made for.

On import, map those columns to the matching Confidentiality, Integrity, and Availability fields and each cell is read as a rating. A cell can hold the label in the importing user's language or one of the codes low, moderate, high, and not_applicable, in any capitalization; Not applicable is accepted for Confidentiality only. A few rules decide what happens:

A blank cell never clears a rating. Blank, or a column you didn't map, means "leave it alone" on an update and "unscored" on a new asset. To clear a rating, set it back to Not set in the asset window, or send an empty value through the API.
An invalid value is reported and skipped. The import prints a red line naming the objective, the value, and the asset, ignores that one rating, and still imports the rest of the row.
A file that changes only scoring is still an update. If the scores are the only difference, the row is reported as updated rather than as needing no change.
Use the codes when the file crosses languages. Labels are matched in the language of the person importing, so a file exported by a French-speaking colleague won't match on an English account. Replace the labels with the codes before importing and it works for everyone.

Common pitfalls

A handful of patterns recur when teams operate the asset inventory.

Unverified list that never gets worked. A program with an unverified list of two hundred assets nobody's touched in six months has effectively disabled the verification discipline by inattention. Either schedule a recurring pass (weekly is reasonable for active programs), or accept that the discipline isn't operating and have an administrator switch on Automatically verify new Assets created through the Asset Selector widget, so at least the list isn't full of assets the program isn't acting on.
Nobody holds the verify permission. Every asset made through a risk form, an assessment, or discovery lands unverified, and nothing can clear it. After narrowing permissions, check that at least one role still carries Able to Verify Assets.
Deleting assets the program still references. Deleting an asset that's linked to open risks or mapped controls quietly takes it off them. Nothing on the risk says an asset used to be there, and the affected-asset count drops without the program noticing why. Before deleting, check the asset's associations (the Associated Risks and Mapped Controls columns, or the GET /api/v2/assets/associations endpoint) and decide whether to delete and lose the links, or to retire the asset with a rename instead.
Sending an asset link to someone outside its teams. Under team separation, a colleague who follows your link to an asset their teams can't see gets "This asset is not available" and nothing else. That's deliberate, not a broken link. Add their team to the asset's Team field if they need it.
Editing Mapped Controls without Governance access. Users without the Governance menu permission see the mapping read-only in the asset window. Saving their other edits leaves the mapping alone, so nothing is lost, but the control work has to go to someone who holds the permission.
Bulk delete on a broad selection. "Select all N assets" follows your filters, so a selection made before you cleared or changed a filter isn't the selection you think it is. Read the count in the confirmation dialog before you commit.
Asset groups treated as static lists. A group named "Production Database Cluster" populated once and never updated drifts as the environment changes: new servers don't get added, decommissioned servers don't get removed. The whole point of the group is that its membership is the live list. Add the group-membership update to whatever change-management process governs the underlying environment.
Skipping the Asset Valuation field. A program that leaves every asset at the default valuation produces risk-scoring math where every linked risk inherits the same impact contribution from the asset, whether it's a developer's test laptop or the production database. Spend the time on the valuation calibration; it's the field that makes risk-impact-by-asset reporting meaningful.
Reading "Not scored" as "low impact." An unscored asset sorts to the bottom of the scoring columns and matches no categorization, band, or rating filter, so a filter for High quietly leaves out every asset nobody has rated. Discovery and imports without scoring columns add assets unscored, so after a big discovery run the share of rated assets can drop fast. Turn on the scoring columns, sort by FIPS Categorization, and work the em-dash rows at the bottom the same way you work the unverified list.
Asset name as a dumping ground. The name field accumulates parenthetical notes ("Web1 (DR pair, decom Q3, owned by Sara)") because the program doesn't have a better place to put the metadata. Use Asset Details for context that doesn't fit the structured fields, and reserve the name for the canonical identifier other systems will reference.
Inventory built once and frozen. First-time inventory population usually completes in a few days of focused work. The inventory becomes a liability the moment it stops being updated; six months later it's a snapshot of what the program used to run. Build a recurring sync mechanism (API-driven from the upstream source of truth, or scheduled discovery runs, plus a cleanup pass on the unverified list) before the first import is even complete.
Encryption Extra on, then querying the database directly. When the Encryption Extra is enabled, the asset name, IP, and details columns are encrypted at the database level. External tools that read the database directly will see ciphertext. Read through the v2 API instead, which decrypts on the way out.
Asset Teams left blank. With Allow all users to see assets not assigned to a team off, an asset with no team is visible to nobody. With it on, that asset is visible to everyone, which defeats the purpose of team-based separation. Pick the teams deliberately; the field is the access-control gate.