38. Assets and Stories

Assets records what each host is for: how critical it is, which environment it belongs to, who owns it, whether the internet can reach it and which business processes depend on it. Criticality drives risk scoring and decides which hardening actions need approval - "an unreviewed asset is a decision made by default."

Stories is where an analyst starts: one timeline per host across detections, DLP, FIM, forensics and defence, so related signals from different modules read as one story.

Permissions:

38.1 The Assets page#

Path: Assets. The page title is Asset intelligence.

• Sync from agents: creates or refreshes an asset profile for every enrolled agent.
• Tiles: Asset profiles, High-risk assets, Unreviewed classification, Business processes.
• Filters: Criticality (critical, high, medium, low), Environment (production, staging, development, unknown), Internet-exposed only, High risk only.
• Asset inventory ("Sorted by risk, highest first"): Host, Risk, criticality and environment (editable in the row), Owner, Exposure, Processes, Last scanned. "impact unknown" means no business process is linked.
• Business processes: Process, criticality, Allowed downtime, Change window, Compliance scope. "Downtime tolerance here is what makes a hardening action 'safe to run now' or 'wait for the change window'."

Click a host for its detail: Why this risk score (the contributing factors), Owner team, Internet exposed, Maintenance window, Allowed downtime, Last scanned, Last hardened, Last incident, Linked processes, Compliance scope and Tags. "No contributing factors recorded. The score is a baseline, not a measurement - run a compliance scan against this host to populate it."

Procedure: classify your assets#

Do this after the agents are enrolled, before the first hardening.

Permission: Manage assets (and Manage agents for step 2).

1. Open Assets.
2. Press Sync from agents so every enrolled host has a profile.
3. Read the Unreviewed classification tile: that many hosts still carry default values.
4. For each host, set the criticality and the environment in its row. The change is saved at once.
5. Run a compliance scan of the hosts (chapter 22) so the risk score has measurements behind it.

What you see: the risk scores and the High-risk assets tile update.

If it fails: a refusal means your role lacks Manage assets; the row keeps its old value.

Business processes are listed here; the console has no form to create, change or delete them in this release.

An asset profile cannot be deleted in the console. Only its criticality and environment are changed in the row; Sync from agents refreshes the rest from the agents.

38.2 The Stories page#

Path: Stories. "What happened on each host, across detections, DLP, FIM, forensics and defence, on one timeline."

• Window: Last 24 hours, Last 3 days, Last 7 days.
• Only hosts seen by two or more modules: shows hosts where signals from different modules coincide - the most likely real incidents.
• One line per host: severity, the modules that saw it, the number of signals.

Click a host to expand its story: the ATT&CK techniques, "Accounts involved", and every signal in time order, each linking to its source (an alert, a DLP incident, a FIM event, a case, a defence action).

Procedure: turn a story into an investigation#

Permission: Run forensics.

1. Open Stories, choose the Window, and tick Only hosts seen by two or more modules.
2. Expand the host and read the signals.
3. Press Open an investigation. A case is opened with the story's summary as its description ("Opened from the attack story (N signals)").
4. Follow Investigation N opened to the case (chapter 34).

If it fails: "Nothing to tell" means no host produced a signal in the window; widen it. A refusal on Open an investigation means your role lacks Run forensics.