> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/asset-groups.md). # Asset groups By grouping assets based on shared attributes, you can address them collectively to enable more efficient bulk actions and simplify scoping across the platform. You can create an asset group by navigating to **Inventory** → **Assets** → **Groups** and clicking **Add Group**. When creating or editing a dynamic asset group, you can enable the **Show only fields supported for access management** option. Enabling this toggle limits the available fields in the **Assets** table to display only the subset of attributes supported for Scope-Based Access Control (SBAC). Using this option ensures that the asset group can be used to define granular user scopes in Access Management. To view the complete and current list of supported scoping attributes, see [Manage user scope](/cortex-xdr-5.x/onboard-cortex-xdr/post-deployment-steps/manage-user-roles-and-access-management/manage-user-scope.md). {% hint style="info" %} ### Note If an asset group uses fields outside of this supported list, it cannot be used for scoping in Access Management. {% endhint %} ### **Dynamic and static asset groups** You can choose between two types of asset groups. Dynamic groups use filters, such as provider or realm, to group current and future assets that meet the defined criteria, while static groups require you to manually select individual assets to include in the group. ### **Use asset groups** After you define asset groups, you can use them for the following: * **Scope-Based Access Control (SBAC)**: Asset groups serve as the foundational building blocks for Asset-led Scope-Based Access Control (SBAC). This allows administrators to explicitly restrict which users can view which assets by defining access to specific Asset Groups, which simultaneously restricts their ability to view related cases and issues for those assets.

Note

Note: You cannot create SBAC based on static groups. When using dynamic asset groups for SBAC, you can limit access based only on the following attributes: Asset Class, Category, Provider, Region, Organization, Realm, Business Application Names, Kubernetes Cluster, Kubernetes Namespace, Code Repository, Hierarchy Path, Resource Group, and Asset Tags.

* **Automation Exclusion Policies:** You can use asset groups for specific automation exclusion policies, such as the IAM User Hard Remediation and User Soft Remediation policies. By using asset groups for these policies, the system enables automatic updates of critical assets without requiring manual edits to a list. These specific exclusion policies can be configured to contain only lists, only asset groups, or a combination of both. * **Enrich asset data:** Add information to a set of assets that isn't directly stored on the asset itself. * **Reuse asset groups:** Reference the same group across different areas of Cortex XDR, for example, in policies and rules. * **Query Asset Groups in XQL**: You can query asset group information directly in Cortex Query Language (XQL) using the `asset_groups` system dataset. {% hint style="info" %} ### Note When you create or edit an Asset Group, the changes are applied immediately to new assets and to existing assets that have been updated. Yet, it may take a few hours for the changes to appear on existing assets that have not been updated. {% endhint %} ### Best practices for asset group management The speed and overall performance of using asset groups depend on the amount of data processed during data creation and access operations. This impacts how fast the system can: Enrich new assets with the asset groups they belong to. * Revisit and update existing assets when an asset group's configuration is changed. * Enforce granular Scope-Based Access Control (SBAC) that checks whether assets can be accessed based on the asset groups they belong to. The data processing and filtering required for grouping and scoping can increase system latency if the rule count or filtering complexity is high. To ensure optimal performance, we recommend the following: * Use short filters and simple comparison operators in your asset group definitions to keep complexity low. * Minimize the number of asset groups each asset belongs to. While a higher number of groups shouldn't significantly impact performance, incorrectly leveraging them for scoping at a very large scale can have a negative impact. * Moderate the total number of asset groups, as an excessively high asset group count can increase latency. .
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/asset-groups.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.