Asset classes

Accelerating remediation: Automated fix suggestions and manual remediation guidance enable developers to resolve code weaknesses directly in the source repository without context-switching to external

The asset inventory organizes your organization's resources into a hierarchy:

1. Class: The highest-level grouping based on general purpose or domain, such as compute, network, or data.
2. Category: A detailed grouping within a class based on normalized function, such as virtual machine, container, or bucket).
3. Type: The most specific, provider-level implementation, such as AWS EC2 instance or GCP Compute Engine instance.

The following asset classes are available in the inventory:

Asset class	Description	License
AI	Provides a detailed view of AI-related assets, their attributes, and associated risks.	Notice This feature is included with a Cloud Posture Security or Cloud Runtime Security add-on.
API	Provides a comprehensive view of Application Programming Interfaces (APIs) across your cloud platforms.	Notice This feature is included with a Cloud Runtime Security add-on.
Application	Provides a high-level summary and detailed insights into the business applications within your environment.	Notice This feature is included with a Cloud Posture Security or Cloud Runtime Security add-on.
Code	Provides an overview of code assets, including all code repositories, Infrastructure as Code (IaC) resources, CI/CD pipelines, and software packages.	Notice This feature is included with the AppSec add-on.
Compute	Provides a detailed overview of compute resources, including CaaS resources, virtual machines, containers, serverless functions, Kubernetes clusters, and general devices.
Data	Provides an overview of data assets and their associated risks, highlighting sensitive assets and assets marked as open to the world.	Notice This feature is included with a Cloud Posture Security or Cloud Runtime Security add-on.
Device	Overview of physical or virtual devices with a Cortex XDR agent installed.
External Surface	Provides an overview of external-facing assets, including services versus websites, domains versus certificates, and their distribution across providers.	Notice This feature is included with the Attack Surface Management (ASM) add-on.
Identity	Provides an overview of identity-related assets, giving visibility into both user and service-based identities and their associated permissions.	Notice This feature is included with a Cloud Posture Security or Cloud Runtime Security add-on or the Identity Threat Module (ITDR) add-on.
Network	Provides an overview of network-related assets, including Load Balancers, Network Interfaces, Security Groups, and Subnets.
Security Services	A complete overview of the security services being actively managed within your environment.
All Other Assets	All assets that are uncategorized.

VM images assets

Cortex VM image scanning is an agentless scanning feature that enables you to inspect the risks and vulnerabilities of a cloud workload without installing an agent or affecting the execution of your workload.

Agentless scanning of VM images is automatically enabled upon onboarding a cloud account to Cortex Cloud. Disabling this feature prevents VM images on your account from being scanned for vulnerabilities and risks, reducing your account's overall security coverage.

Cortex Agentless scanning includes private virtual machine images across the following major cloud platforms:

• Amazon Web Services (AWS): Cortex exclusively scans private Amazon Machine Images (AMIs).
• Microsoft Azure: Scanning is limited to private gallery versioned Images.
• Google Cloud Platform (GCP): Cortex Cloud supports scanning of private VM images.

After you onboard your cloud account, it is continuously scanned regardless of how many workloads are under that account. Whether you add or remove hosts and containers, agentless scanning keeps your workload’s security issues visible.

VM images assets inventory

To access VM images assets, go to Inventory, select All Assets → Compute → VM Images.

The VM images assets page includes a dashboard and an inventory table.

VM images asset table

The following table describes the default exposed properties of the VM images asset table. Select the column picker to view additional properties.

Column	Description
Provider	Cloud Account Provider
Name	Name of the VM image
Region	Geographical location within a cloud provider's infrastructure where that VM image is located
Architecture	Architecture of the VM image. For example: x86_64
Image OS	The OS distribution version. For example: 2020 or 20
OS Distribution	Operating System distribution details
Operating System	Operating System on the VM image
OS version	Version of the operating system
Tags	User-defined label to correlate VM images and Instances
Size	Size of the VM image
Created At	The time when the VM Image was created in the Cloud provider
First Observed	The first scan time of the VM image
Last Observed	The last scan time of the VM image
Scanners	List of scanners that have successfully scanned the Core Image asset. As the core image can be scanned by multiple scanners, the values are stored as a concatenated string of all scanner types. If no scanner data exists for an asset in the database, the default value is an empty array. This column is hidden from the default view. Note The data in the Scanners column is accurate only for Core Image assets. Ignore the Scanners value for assets categorized as Registry, Build, or Runtime images, as it may not reflect an accurate scan status.
Last Scan	The Last Scan time reflects the most recent scan across all scanners for a Core Image. If no scan data is available in the database for the core image, the default value is 0. This column is hidden from the default view. Note The Last Scan value is only accurate for Core Image assets; ignore the Last Scan values for Registry, Build, and Runtime images, as they may be incorrect.

VM images asset details

The VM image asset card provides a unified view of a VM image, consolidating VM details and related configuration issues and vulnerabilities found during VM image scanning.

Ask the AppSec agentic assistant agent

From the VM Images table, right-click a VM image > Open in Agentic Assistant > select Application Security from the agents menu, and query VM image specific insights. This action is also available from the VM image side panel.

Asset card tabs

• Overview tab: Displays a high-level summary of the VM image including OS details, findings, cases, VM scan information, and the relationship graph between the VM instance and the VM image.

  Note

  If the VM image is not used to create any VM instance, the graph section will show no results. This feature enables you to precisely identify the registry and repository source of any running image, directly linking runtime security findings to their origin. As a result, you can answer audit and security questions, such as determining which registry images are currently deployed in runtime.
• Configurations tab: Lists all the cloud configuration issues seen during the VM image scanning. The Asset Configuration JSON section provides details of the VM image in JSON format.
• Vulnerabilities tab: Lists the vulnerability findings during VM image scans as well as the packages with related vulnerabilities found during VM image scans.

Identity assets

Powered by the Cortex Cloud Identity Security module, the Identity Asset Inventory helps you discover your entire cloud identity estate. It analyzes your environment to determine exactly what actions identities can take and which resources they can access, providing the context needed to trigger security detection rules.

Identity categories

The identity inventory is organized into the following categories:

• All Identity Assets: Provides a view of all identity-related assets
• Human Identities: All cloud, identity provider (IdP), and platform users.
• Machine Identities: Non-human identities that can assume permissions and perform cloud Identity and Access Management (IAM) actions, such as VMs and functions.
• Managed Vaults: Tracks secure storage environments for credentials and keys.
• Secrets: Provides an inventory of credentials to help identify active or dormant secrets and review their replication and compliance
• External Identity Providers: Tracks third-party identity services integrated with your environment.
• Cloud Service Accounts: A category unifying AWS roles, Microsoft Azure service accounts and managed Identities, and Google Cloud Platform (GCP) service accounts.
• IAM Group Tracks Identity and Access Management groups.
• IAM Policies: Tracks permission documents, such as AWS policies, Azure roles, and Google Cloud Platform roles

Expanded identity details

Clicking an identity asset in the inventory opens a detailed asset card that provides deep contextual analysis. Because managing identity security requires understanding how assets interact with one another, the information available on these cards helps map the complex web of relationships and permissions within your environment.

While the specific layout changes depending on whether you are viewing a human identity, a machine identity, or a secret, the asset details generally provide an aggregated view of the permissions associated with the asset. By exploring the identity details, you can understand exactly how an identity is granted its permissions by viewing the groups it belongs to, the cloud service accounts it can impersonate, and any policy attachments or inline policies. You can also review an identity's specific access levels to destination assets, which highlights unused permissions, excessive permissions, and the account access type

Effective permission calculation

Cortex XDR dynamically calculates exactly what actions an identity can take and which resources it can access, analyzing the complex web of relationships and nested groups to track effective usage across the environment.