> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/asset-managment/asset-classes/identity-assets.md).

# Identity assets

Powered by the Identity Security module, the Identity Asset Inventory helps you discover your entire cloud identity estate. It analyzes your environment to determine exactly what actions identities can take and which resources they can access, providing the context needed to trigger security detection rules.

**Identity categories**

The identity inventory is organized into the following categories:

* **All Identity Assets:** Identities originating from all platforms and sources.
* **Human:** All cloud, identity provider (IdP), and platform users.
* **Non-human:** Machine identities that can assume permissions and perform cloud Identity and Access Management (IAM) actions such as VMs and functions.
* **Groups:** Identity and Access Management groups.
* **Policies:** Permission documents, such as AWS policies, Azure roles, and GCP roles.

For each identity category, you can refine the results using the tabs:

* **All Identities**: Identities originating from all platforms and sources.
* **Cloud Identities**: Identities originating from cloud platforms.
* **SaaS Identities**: Identities originating from SaaS data sources.
* **On-premises Identities**: Identities managed within your on-premises or enterprise directories.\
  For **Human** identities, the **On-premises Identities** tab includes the **Weak Password** widget to filter the users in your organization who are likely to be targeted because they have a weak password.

  <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>Access to the <strong>Weak Password</strong> widget and column requires the ITDR add-on.</p></div>

  <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>Once a user updates their password to a strong password, they will no longer appear in the filtered weak password results.</p></div>

**Expanded identity details**

Clicking an identity asset in the inventory opens a detailed asset card that provides deep contextual analysis. Because managing identity security requires understanding how assets interact with one another, the information available on these cards helps map the complex web of relationships and permissions within your environment.

While the specific layout changes depending on whether you are viewing a human identity, a machine identity, or a secret, the asset details generally provide an aggregated view of the permissions associated with the asset. By exploring the identity details, you can understand exactly how an identity is granted its permissions by viewing the groups it belongs to, the cloud service accounts it can impersonate, and any policy attachments or inline policies. You can also review an identity's specific access levels to destination assets, which highlights unused permissions, excessive permissions, and the account access type.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/asset-managment/asset-classes/identity-assets.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.