> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cloud-inventory-and-environment/asset-classes/device-assets.md). # Device assets Navigate to **Inventory** → **All Assets** → **Device** → **General Devices** to view your inventory of physical and virtual endpoints, such as PCs, laptops, servers, and mobile devices, that are protected by an installed Cortex XDR agent. {% hint style="info" %} ### Note The device assets inventory requires deployed Cortex XDR agents. {% endhint %} ### Asset details and status The device inventory tracks vital operational and connectivity data for each asset. Analysts can view the endpoint status to see if the agent is Connected, Disconnected, or Lost, the operational status to verify if the endpoint is Protected, Partially Protected, or Unprotected, as well as the Agent Version, Operating System, and the last logged-in User. ### Host insights For deeper visibility, device assets support Host Insights. This feature collects extensive business and IT operational data from the endpoint, including installed applications, autoruns, mounted disks, local user groups, and running services. This allows analysts to quickly identify anomalies, such as a suspicious service or an unauthorized autorun added to a device. ### Direct remediation actions Because these device assets are actively managed by the XDR agent, analysts can execute direct response actions on the asset during an investigation. Supported actions include: * **Isolating the Endpoint:** Halting all network access on the device (except for traffic to Cortex XSIAM) to prevent a compromised device from communicating with other internal or external networks. * **Live Terminal:** Initiating a remote connection to manage files, active processes, and run system commands. * **Script Execution & File Retrieval:** Running Python scripts directly on the device or retrieving specific files (up to 20 files or 500MB) for further forensic analysis. ### Asset cleanup To ensure the device inventory remains accurate and clutter-free, administrators can perform one-time or periodic cleanups of duplicated entities. If a device is removed, its data is retained for 90 days from the last connection timestamp, and the data will be seamlessly recovered if the device reconnects in the future. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cloud-inventory-and-environment/asset-classes/device-assets.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.