Assets

Assets is your single inventory of devices, reconciled across every source. The list lives at Inventory → Assets (/devices); clicking a row opens the asset detail at /device/<id>.

What makes an asset “one row”

The same physical machine is usually reported by several tools under slightly different names — a full DNS hostname from Intune and SentinelOne, and its 15-character NetBIOS twin from ConnectWise Automate. The backend consolidates these so one machine = one asset row:

• Devices are grouped by an identity key of the uppercased, 15-character truncated hostname, which collapses the DNS name and its NetBIOS form together.
• The canonical display name is the longest observed name (i.e. the full DNS form).
• Every tool that reported the machine contributes a source chip.

The Assets list

KPI strip

Five tiles across the top (from /devices/stats): Total Devices, Intune, SentinelOne, Rapid7, and Matched (assets seen in more than one source).

Source chips

Each row shows which tools reported the machine:

Chip	Source
Intune	Microsoft Intune
S1	SentinelOne
R7	Rapid7
Automate	ConnectWise Automate
AutoElevate	AutoElevate (CSV)

When a row carries more than one chip, a small link icon indicates the asset was matched across sources.

Columns

Device Name (links to the detail page), User (name + email), Platform, OS Version, Sources (chips), and Apps (installed-software count). Columns can be shown/hidden and sorted via the grid’s column picker and header clicks.

Search & the query builder

• The search box does a free-text match across assets (press Enter or Search).

• Query builder opens a drawer for structured filtering. Fields are grouped by source so you can filter on shared attributes (device name, OS platform, installed app, app count, source) or source-specific ones:

  Group	Example fields
  General	Device name, OS platform, User email, Installed app, Source
  Microsoft Intune	Compliance state, Owner type, Manufacturer, Model, Serial, Enrolled/Last sync
  SentinelOne	Agent version, Infected, Active, Threat count, Site/Group, Network status
  Rapid7	IP / MAC address, Risk score, Vulnerabilities count, Critical/Severe vulns, Tags

  Source-prefixed fields (intune., s1., r7.) are joined in server-side, and every field is validated against a server allow-list. See the query-builder section of the Frontend reference.

• Results are paginated (20 / 50 / 100 / 200 per page). The current search, page, and query are reflected in the URL, and Copy query URL (the ⋯ menu) produces a shareable link.

The asset detail page

Opening an asset loads its consolidated record and then fans out to each source by device name — SentinelOne, Rapid7, ConnectWise Automate, and AutoElevate are all fetched via .../device-by-name/<name> endpoints, so a source only appears if it actually has that machine.

Header & KPIs

The header shows the device name, a status badge (Active if a SentinelOne agent is present), the copyable device id, and a Manage menu (run vulnerability scan, refresh from all sources, export to JSON, and merge/delete actions — some of which are stubs). Four KPI cards summarize:

• Security Status — Protected / Inactive / Unmonitored, based on the S1 agent.
• Vulnerabilities — total with a Critical · High breakdown.
• Applications — installed-software count.
• Active Threats — unmitigated SentinelOne threats.

Asset information + source-grouped Attributes

Two panels sit side by side:

• Asset information — a key/value grid (id, organization, site, status, category, type, OS, hardware, first/last seen, risk, tags, sources, …) plus a free-form comments box.
• Attributes — the runZero-style panel: a vertical SourceTabs rail with one tab per source that has data, and an AttributeTable showing that source’s flattened attributes. Tabs are labeled like inventory.local, sentinelone.dev, rapid7.dev, cw-automate.dev, and autoelevate.dev, each with a count. This is the same component pair used on the user detail page. See the Frontend reference.

Below these, network-identity panels list Addresses / Hostnames / Domain Names / MAC Addresses and Ownership / Recent Users.

The per-source tabs

A tab strip organizes the deeper detail:

Tab	Contents
Findings	Rapid7 findings for the asset, with a per-CVE Research action that enriches the finding.
Vulnerabilities	Results of per-application CVE scans, sorted by CVSS, with a Run scan button.
Software	Installed applications on the machine, with source chips; each links into Software.
SentinelOne	Agent status/version, threat history, and S1-reported apps.
Rapid7	InsightVM asset facts, risk score, and a Critical/Severe/Total breakdown.
CW Automate	ConnectWise Automate attributes (RMM).
AutoElevate	AutoElevate privilege-posture attributes (from CSV import).

If a source has no record for the machine, its tab shows a “Not in <source>” prompt to run that integration’s sync.

Related

• Software inventory · Vulnerabilities
• Integrations: SentinelOne, Rapid7, Intune, ConnectWise Automate