asset

The asset lookup table stores metadata of imported assets such as hostnames, IPs, ownership, criticality, FQDNs, operating systems, or location, among several more. This table is automatically refreshed whenever new asset data is ingested. This asset data enriches search results with asset context for more accurate monitoring and reporting. The table is read-only and cannot be manually modified.

(Click the image to enlarge it)

Field	Value Type	Description	Example
asset_id	string	Uniquely identifies the asset across data sources and imports.	device-12345
asset_kind	string	Defines the high-level class of the asset.	device
asset_type	string	Specifies the functional type of the asset.	server
asset_category	string	Categorizes the asset based on its role or usage context.	endpoint
asset_risk_score	int	Represents a computed risk score for the asset based on security posture and exposure.	78
asset_role_function	string	Used to determine whether observed activity aligns with normal role-based behavior.	firewall, dmz, database
asset_status	string	Indicates the current operational or lifecycle state of the asset.	Active
alt_fqdns	array	Lists alternate fully qualified domain names associated with the asset.	["webserver01.internal.example.com"]
alt_ip_addresses	array	Contains additional IP addresses observed for the asset.	["10.0.1.7"]
alt_mac_addresses	array	Stores alternate MAC addresses linked to the asset.	["00:1b:63:84:45:e7"]
confidence	int	Indicates the confidence level of asset identification and correlation.	95
criticality	string	Security importance of the asset.	low, medium, high, critical
department	string	Identifies the organizational unit or team that owns or uses the asset.	Engineering, IT
environment	string	Describes the deployment environment in which the asset operates.	Production
first_seen	string	Records the timestamp when the asset was first observed.	2024-10-01T08:12:00Z
fqdns	string	Stores the fully qualified domain name associated with the asset.	qa-win10.example.com
hostname	string	Represents the system hostname used to identify the asset on the network.	webserver01
ip_address	string	Contains the IPv4 or IPv6 address assigned to the asset.	1.2.3.4
is_critical_asset	boolean	Indicates whether the asset is business-critical or security-sensitive. Used as a risk multiplier in scoring and prioritization.	true
last_seen	string	Records the timestamp when the asset was most recently observed.	2025-01-05T14:25:00Z
last_change_date	string	Timestamp of the last significant configuration or state change on the asset. Helps reduce noise and improve change-aware detections.	2026-01-08T22:14Z
last_patch_date	string	Timestamp of the most recent successful patch applied to the asset. Helps correlate behavioral changes and adjust risk scoring.	2026-01-02T03:15Z
location	string	Describes the physical or logical location of the asset.	Data Center 1
mac_address	string	Stores the MAC address of the network interface associated with the asset.	00:1b:63:84:45:e6
netbios	string	Captures the NetBIOS name of the asset, if available.	QA-WIN10
network_zone	string	Identifies the network trust zone where the asset resides. Provides directional context and helps determine asset exposure and criticality.	prod
owner	string	Identifies the individual or group responsible for the asset.	IT Ops, Security Team
patching_state	string	Represents the current patch lifecycle status of the asset (normal, actively patching, or delayed). Used to dynamically tune UEBA sensitivity.	normal, in_progress, extended
peer_group	string	Logical grouping of similar assets (by role, platform, and environment) used for peer-based baselines and comparative risk scoring.	linux_servers_prod
platform	string	Specifies the operating system or platform running on the asset.	Windows, Cent OS, Linux
platform_version	string	Specifies the version of the operating system or platform running on the asset.	20.04
scanner	string	Indicates the source or tool that imported or discovered the asset data.	tenable.io
source	string	Identifies the data source that provided or last updated the asset record.	EDR
tags	array	Holds user-defined or system-generated labels for classification or filtering.	["pci", "production", "qa"]
timestamp	long (Epoch milliseconds)	Records the time when the asset record was last updated or ingested.	1734682920000
vulnerabilities	array	Stores the number of known vulnerabilities associated with the asset, typically sourced from the scanner or import feed.	[ { "cve_id": "CVE-2024-12345", "severity": "high", "status": "open" } ]