The Assets page lists what your controls protect: datacentres, offices, network gear, applications, databases, cloud platforms, SaaS services and more. This page explains how to register and maintain assets in Command, how to see which controls protect each one, and where assets imported from your CMDB and clouds come from.
Your assets live in MESH, Soveryne's shared asset register. Command, ATLAS and MESH all read and write the same register, so an asset you register here is the same record that MESH imports and ATLAS discovers. See MESH.
Who uses it
Role
What they do here
Admin
Registers, edits, retires and restores assets, ties controls to them, and answers the import questions under Connected sources
Security manager
Registers, edits, retires and restores assets, and ties controls to them
Policy editor
Views assets and ties controls to them
Auditor and Incident responder
View assets
Before you begin
Fill in your organisation profile if you want Command to suggest assets for you. See Organisation profile.
To import assets automatically from ServiceNow, Microsoft Azure, AWS or Google Cloud, connect them in MESH. See Connecting sources.
The Assets page
Click Assets in the top navigation. The number next to it shows how many assets you have.
Search assets… finds assets by name.
Kind filters on All, Physical or Virtual.
Criticality filters on All, Critical, High, Medium or Low.
Classification filters on All, Public, Internal, Confidential or Restricted.
Each row shows the asset's name and location, whether it is physical or virtual, its category, criticality and classification, and how many controls protect it (ctrl). Retired assets stay in the list, greyed out and marked RETIRED.
Click a row to see the asset's details in the panel on the right.
The Assets page with the asset register and the details of one asset
Asset details
The details panel shows:
Labels: criticality, classification and kind, and where they apply Crown jewel, ATLAS (found by an ATLAS scan), Imported (reported by a connected CMDB or cloud) and No longer reported.
Location and Status.
Observed by ATLAS, when ATLAS has seen the asset: Hostname, Address, Operating system, Open ports and Last seen. These facts are read-only.
Reported by connected sources, when a connected CMDB or cloud reports the asset: for example the name at the source, resource type, cloud, account and region, state, owner at the source, environment, operating system, addresses, tags and when it was last imported. These facts are read-only; they change only when the source changes.
Merged records, when the import combined several records into this asset. See Split off a merged record.
Protected by: the controls that protect this asset, with their frameworks and implementation score. Click one to open it. When none do, the panel says No controls protect this asset. Draft one to remediate.
At the bottom are Add protecting control and Edit asset.
When no connected source reports an asset any more, the panel says No connected source reports this asset any more (since {when}). It is not retired — that stays your decision. Command never retires an asset by itself.
Register an asset
Who can do thisAdmin and Security manager.
1
Click Register asset.
2
Under 1 What kind of asset?, choose Physical (datacentres, offices, network gear, devices, vehicles, on-premises servers) or Virtual (applications, websites, databases, cloud, SaaS, code, identity, documents).
3
Under 2 Pick a category, choose a category:
Physical:Datacenter, Office building, Server (on-prem), Network gear, Device fleet or Vehicle / fleet.
Virtual:Application, Website, Database, Data store, Cloud platform, Identity & access, SaaS, Code repository, API / integration, Software license or Document / report.
4
Under 3 Details, enter the Asset name. It is required.
5
Fill in the fields for the category, for example a database's engine and retention, and Location / hosting.
6
Choose the Classification and the Criticality to the business (Low, Medium, High or Critical).
7
Optionally, add a Description and the Technologies the asset runs, separated by commas, for example "nginx, PHP". Command uses the technologies to match threat advisories to your assets.
8
Click Register asset. Command shows the asset's name followed by registered.
The Register asset window with the kind, category and details steps
To start from a suggestion, click Suggest from profile at the top of the window. Command reads your organisation profile and lists the assets it expects you to have. Click one to fill in the form, check it, and click Register asset. Nothing is saved until you do.
Registering the same system twice does not create a duplicate: Command updates the one record.
Watch: registering an asset (about 1 min)
Edit an asset
Who can do thisAdmin and Security manager.
1
Select the asset and click Edit asset, or choose Edit asset in the row menu (⋮).
2
Change the details.
3
Click Save changes. Command shows the asset's name followed by updated.
Everything you did not change stays as it was, including the category details, the Crown jewel label and when the asset was last reviewed.
Facts reported by ATLAS or a connected source cannot be edited here; they follow the source.
Protect an asset with controls
Command can find which of your existing controls already protect an asset, and help you draft a new one for the gap.
Who can do thisAdmin and Security manager run the analysis. Admin, Security manager and Policy editor can tie controls to assets.
1
Select the asset and click Add protecting control, or choose Add control in the row menu (⋮). The Protect window opens and shows Analysing existing controls for the asset.
2
Review the result. Command lists Existing controls that protect this asset, each with a one-line reason, and tells you whether coverage is sufficient or what the gap is.
3
Choose what to do:
Bind {n} control(s) ties the ticked controls to the asset.
Bind & done ties them when coverage is sufficient.
Bind & draft gap control, or Draft control for gap when you tick nothing, ties the controls and opens the control editor with a new draft for the gap, already tied to the asset. Review and save the draft. See Controls.
Command shows Bound {n} control(s) to followed by the asset's name. Command only proposes your own controls.
You can also tie a control to an asset from the control itself: under Protected assets, click Bind to an asset. See Tie the control to assets.
Retire and restore an asset
Command never deletes assets. When an asset is no longer in use, retire it.
Who can do thisAdmin and Security manager.
1
Open the row menu (⋮) of the asset.
2
Choose Retire. Command shows the asset's name followed by retired. The asset stays in the list, marked RETIRED.
To bring it back, choose Restore in the same menu. Command shows the asset's name followed by restored, with its details as they were.
Retired assets are left out of the Dashboard's asset metrics and of threat matching.
Split off a merged record
When the import from your connected sources decided that several records describe one asset, the details panel lists them under Merged records. If they are in fact different things, split one off.
Who can do thisAdmin.
1
Under Merged records, click Split off next to the record.
2
Explain why these are different things. The confirmation stays disabled until you do.
3
Click Split off. Command shows Split off. The importer will not merge these again on the same evidence.
Connected sources
Click Connected sources at the top of the Assets page to see where your imported assets come from.
The Sources tab lists each connected source with the time of its last import. Connections themselves are managed in MESH: click Open MESH. See Connecting sources.
The Review queue tab lists the questions the import asks you instead of guessing: records that may be one asset, two assets with the same public address, a large drop that might be a lost permission rather than removed systems, and merge chains that need attention.
Who can do thisAdmin.
For each question in the Review queue:
For a possible duplicate, click Merge them or They are different.
For a large drop, click Confirm the drop to apply it at the next import, or Keep them.
For a merge chain, click Acknowledge.
Optionally, add a Note for the audit trail first. When the queue is empty, it says Nothing is waiting for you.
How Command protects you
Assets are never deleted in Command, only retired; you can restore them.
An asset that disappears from every connected source is flagged, never retired automatically.
A large drop in an import waits for a person to confirm it.
Facts observed by ATLAS and reported by connected sources are read-only in Command.
Registering the same system twice updates one record instead of creating a duplicate.
Every change to the register is attributed to the person who made it.
A review decision is refused when the facts behind the question changed after you opened the page, so you never decide on stale information.
If the register cannot be read, Command shows an error. It never shows a failed read as an empty register.
Troubleshooting
What you see
What it means
What to do
The asset register could not be read. with Try again
Command could not reach the asset register
Click Try again. If it keeps failing, contact your partner or Soveryne.
No assets match those filters.
No asset matches your search and filters, or there are no assets yet
Clear the search and set the filters to All
Register failed or Update failed
The change was refused, for example because your role does not allow it
Check your role. An Admin or Security manager can register assets.
No suggestions from the profile yet — fill it in first.
Your organisation profile is too empty to suggest assets
Complete the profile on the Organisation page
Couldn't analyse coverage. You can still draft a control manually.
The analysis could not run
Draft a control yourself on the Controls page
Binding failed
Tying a control to the asset was refused
Check your role and try again
The connected sources could not be read.
The sources or the review queue could not be loaded, or your role cannot see them
Click Try again. Ask an Admin.
MESH is not linked to this workspace.
Your workspace has no MESH link yet
Contact your partner or Soveryne
the facts behind this question changed after the page loaded; look again
The import changed something after you opened the queue
