Understanding Response Parameters in CSAM API Responses
Date Parameters
CSAM provides several key date fields that help you understand when an asset was created, updated, and last observed by sensors. Because data in CSAM is aggregated from multiple sources, such as agents, scanners, and third-party integrations, each date serves a specific purpose.
The table below describes each date field returned in CSAM API responses, along with the equivalent token you can use to search for the same data in the CSAM UI.
| Field Name | Description | Equivalent UI Tokens |
|---|---|---|
| createdDate | The createDate is the date when the asset was first created in the CSAM inventory. | asset.createdDate: |
| lastModifiedDate | The LastModifiedDate is updated for both platform- and non-platform-related events, indicating that it changes whenever any event associated with that asset is processed, rather than just for scan events. This includes activities such as connector synchronizations, cloud view metadata refreshes, reconciliations, module activations, tag assignments/removals, purge events, and others. | asset.lastUpdatedDate: |
| sensorLastUpdatedDate | The sensorLastUpdatedDate is refreshed through endpoint-driven updates from all sources. This date consolidates updates from each source and indicates the most recent update. | asset.lastInventoryDate: |
Response Parameters
The following table provides the description of all the response parameters from the Asset Host Data APIs:
| Parameter | Description |
|---|---|
| responseMessage | Indicates whether the API request was successful. |
| responseCode | Outcome of the API request. |
| count | Total number of asset records returned in this response payload. |
| hasMore | Pagination flag indicating whether additional records exist beyond this response. 0 means no more records. |
| lastSeenAssetId | ID of the last asset seen, used as a cursor for paginating through large result sets. |
| assetListData.asset.assetId | Unique numeric identifier assigned to the asset within the platform. |
| assetListData.asset.assetUUID | Globally unique UUID for the asset, used for cross-system referencing. |
| assetListData.asset.hostId | Internal identifier for the physical or virtual host associated with this asset. |
| assetListData.asset.agentId | ID of the installed agent on this asset. Null if no agent is deployed. |
| assetListData.asset.createdDate | Timestamp when the asset record was first created in the system. |
| assetListData.asset.lastModifiedDate | Timestamp of the most recent update to any attribute of this asset record. |
| assetListData.asset.sensorLastUpdatedDate | Timestamp when the sensor last updated data for this asset. |
| assetListData.asset.assetType | Classification of the asset (e.g., "HOST" for a network-connected device or server). |
| assetListData.asset.address | Primary IP address (IPv4 or IPv6) of the asset. |
| assetListData.asset.dnsName | Fully qualified domain name (FQDN) resolved for this asset. |
| assetListData.asset.assetName | Human-readable display name assigned to the asset. |
| assetListData.asset.netbiosName | NetBIOS hostname used to identify the device on Windows-based networks. |
| assetListData.asset.timeZone | UTC offset representing the configured time zone of the asset (e.g., "+05:30"). |
| assetListData.asset.biosDescription | Descriptive text about the BIOS (e.g., manufacturer, version) if available. |
| assetListData.asset.lastBoot | Timestamp of the last recorded system boot or restart for this asset. |
| assetListData.asset.totalMemory | Total installed RAM on the asset, reported in bytes. |
| assetListData.asset.cpuCount | Number of logical CPU cores detected on the asset. |
| assetListData.asset.lastLoggedOnUser | Username of the last person who logged into this asset interactively. |
| assetListData.asset.domainRole | Role of this asset within a Windows domain (e.g., member server, domain controller). |
| assetListData.asset.hwUUID | Hardware UUID sourced from BIOS/firmware, used for physical device identification. |
| assetListData.asset.biosSerialNumber | Serial number as reported by the device BIOS/firmware. |
| assetListData.asset.biosAssetTag | Asset tag string embedded in the BIOS, often used for inventory management. |
| assetListData.asset.isContainerHost | Indicates whether this asset is running a container platform (e.g., Docker, Kubernetes). |
| assetListData.asset.operatingSystem.osName | Short name of the detected operating system or firmware. |
| assetListData.asset.operatingSystem.fullName | Full descriptive name of the operating system including edition details. |
| assetListData.asset.operatingSystem.category | Combined category classification of the OS in "Category1 / Category2" format. |
| assetListData.asset.operatingSystem.category1 | Primary category of the operating system (e.g., "Unidentified", "Windows"). |
| assetListData.asset.operatingSystem.category2 | Secondary category providing further classification of the OS type. |
| assetListData.asset.operatingSystem.productName | Normalized product name of the operating system. |
| assetListData.asset.operatingSystem.publisher | Vendor or organization that publishes the operating system. |
| assetListData.asset.operatingSystem.edition | Specific edition of the OS (e.g., "Professional", "Server Standard"). |
| assetListData.asset.operatingSystem.marketVersion | Marketing version label of the OS as presented to end users. |
| assetListData.asset.operatingSystem.version | Technical version number of the operating system. |
| assetListData.asset.operatingSystem.update | Specific update, patch, or service pack applied to the OS. |
| assetListData.asset.operatingSystem.architecture | CPU architecture the OS is built for (e.g., "x86_64", "ARM64"). |
| assetListData.asset.operatingSystem.lifecycle.gaDate | Date the OS version became generally available (GA release). |
| assetListData.asset.operatingSystem.lifecycle.eolDate | Date the OS reached end-of-life (EOL), after which no further updates are provided. |
| assetListData.asset.operatingSystem.lifecycle.eosDate | Date the OS reached end-of-support (EOS), after which vendor support is discontinued. |
| assetListData.asset.operatingSystem.lifecycle.stage | Current lifecycle stage of the OS (e.g., "Not Applicable", "EOL", "Active"). |
| assetListData.asset.operatingSystem.lifecycle.lifeCycleConfidence | Confidence level of the lifecycle data (e.g., "Exact", "Calculated"). |
| assetListData.asset.operatingSystem.lifecycle.eolSupportStage | Description of the support stage at end-of-life. |
| assetListData.asset.operatingSystem.lifecycle.eosSupportStage | Description of the support stage at end-of-support. |
| assetListData.asset.operatingSystem.lifecycle.detectionScore | Confidence score for the lifecycle detection, where higher values indicate greater certainty. |
| assetListData.asset.operatingSystem.taxonomy.id | Internal taxonomy identifier for the OS classification. |
| assetListData.asset.operatingSystem.taxonomy.name | Full taxonomy name combining category1 and category2. |
| assetListData.asset.operatingSystem.taxonomy.category1 | Primary taxonomy category for the OS. |
| assetListData.asset.operatingSystem.taxonomy.category2 | Secondary taxonomy category for the OS. |
| assetListData.asset.operatingSystem.productUrl | URL pointing to the official product page or reference for this OS. |
| assetListData.asset.operatingSystem.productFamily | Product family the OS belongs to (e.g., "Windows Server"). |
| assetListData.asset.operatingSystem.installDate | Date the operating system was installed on this asset. |
| assetListData.asset.operatingSystem.release | Release label or codename for the OS version. |
| assetListData.asset.operatingSystem.cpeId | Internal ID referencing the CPE (Common Platform Enumeration) entry for this OS. |
| assetListData.asset.operatingSystem.cpe | Standardized CPE URI string for the OS, used for vulnerability matching. |
| assetListData.asset.operatingSystem.cpeType | Source or standard for the CPE entry (e.g., "NIST"). |
| assetListData.asset.hardware.fullName | Full descriptive name of the hardware device. |
| assetListData.asset.hardware.category | Combined hardware category in "Category1 / Category2" format (e.g., "Networking Device / Print Server"). |
| assetListData.asset.hardware.category1 | Primary hardware category (e.g., "Networking Device", "Endpoint"). |
| assetListData.asset.hardware.category2 | Secondary hardware category providing further device classification. |
| assetListData.asset.hardware.manufacturer | Name of the company that manufactured the hardware device. |
| assetListData.asset.hardware.productName | Normalized product name of the hardware as identified by the platform. |
| assetListData.asset.hardware.model | Specific model identifier for the hardware device. |
| assetListData.asset.hardware.lifecycle.introDate | Date the hardware was first introduced to the market. |
| assetListData.asset.hardware.lifecycle.gaDate | Date the hardware became generally available for purchase. |
| assetListData.asset.hardware.lifecycle.eosDate | Date the hardware reached end-of-support. |
| assetListData.asset.hardware.lifecycle.obsoleteDate | Date the hardware was declared obsolete by the manufacturer. |
| assetListData.asset.hardware.lifecycle.stage | Current lifecycle stage of the hardware (e.g., "Unknown", "Active", "Obsolete"). |
| assetListData.asset.hardware.lifecycle.lifeCycleConfidence | Confidence level of the hardware lifecycle data. |
| assetListData.asset.hardware.taxonomy.id | Internal taxonomy identifier for the hardware classification. |
| assetListData.asset.hardware.taxonomy.name | Full taxonomy name for the hardware combining category1 and category2. |
| assetListData.asset.hardware.taxonomy.category1 | Primary taxonomy category for the hardware. |
| assetListData.asset.hardware.taxonomy.category2 | Secondary taxonomy category for the hardware. |
| assetListData.asset.hardware.productUrl | URL pointing to the official product page or reference for this hardware. |
| assetListData.asset.hardware.productFamily | Product family the hardware belongs to. |
| assetListData.asset.openPortListData.openPort.port | Port number detected as open on the asset. |
| assetListData.asset.openPortListData.openPort.protocol | Network protocol associated with the open port (e.g., "TCP", "UDP"). |
| assetListData.asset.openPortListData.openPort.description | Human-readable description of the service or protocol commonly associated with this port. |
| assetListData.asset.openPortListData.openPort.detectedService | Name of the service detected running on this port (e.g., "Elasticsearch", "MONGODB"). |
| assetListData.asset.openPortListData.openPort.firstFound | Timestamp when this open port was first detected on the asset. |
| assetListData.asset.openPortListData.openPort.lastUpdated | Timestamp when this open port record was last refreshed. |
| assetListData.asset.openPortListData.openPort.authorization | Authorization status of the open port (e.g., authorized, unauthorized). Null if not evaluated. |
| assetListData.asset.openPortListData.openPort.detectionScore | Confidence score for the service detection on this port. |
| assetListData.asset.openPortListData.openPort.discoverySources | Method or scanner used to discover this open port (e.g., "IP Scanner"). |
| assetListData.asset.volumeListData.volume.name | Name or drive letter of the storage volume (e.g., "C:"). |
| assetListData.asset.volumeListData.volume.size | Total capacity of the storage volume in bytes. |
| assetListData.asset.volumeListData.volume.free | Available free space remaining on the storage volume in bytes. |
| assetListData.asset.networkInterfaceListData.networkInterface.hostname | Hostname associated with this network interface. |
| assetListData.asset.networkInterfaceListData.networkInterface.addressIpV4 | IPv4 address assigned to this network interface. |
| assetListData.asset.networkInterfaceListData.networkInterface.addressIpV6 | IPv6 address assigned to this network interface. |
| assetListData.asset.networkInterfaceListData.networkInterface.macAddress | Hardware MAC address of the network interface card. |
| assetListData.asset.networkInterfaceListData.networkInterface.interfaceName | System name of the network interface (e.g., "eth0", "en0"). |
| assetListData.asset.networkInterfaceListData.networkInterface.dnsAddress | DNS server address configured on this network interface. |
| assetListData.asset.networkInterfaceListData.networkInterface.gatewayAddress | Default gateway IP address configured on this network interface. |
| assetListData.asset.networkInterfaceListData.networkInterface.manufacturer | Manufacturer of the network interface card, typically derived from the MAC address OUI. |
| assetListData.asset.networkInterfaceListData.networkInterface.macVendorIntroDate | Date the MAC address vendor prefix was registered. |
| assetListData.asset.networkInterfaceListData.networkInterface.netmask | Subnet mask for the IP address assigned to this interface. |
| assetListData.asset.networkInterfaceListData.networkInterface.addresses | List of additional IP addresses assigned to this network interface. |
| assetListData.asset.softwareListData.software.id | Unique internal identifier for the detected software record. |
| assetListData.asset.softwareListData.software.discoverySources | Method used to detect this software on the asset (e.g., "IP Scanner", "Cloud Agent"). |
| assetListData.asset.softwareListData.software.fullName | Full normalized name of the software including publisher and version. |
| assetListData.asset.softwareListData.software.softwareType | Classification type of the software (e.g., "Application", "OS Component"). |
| assetListData.asset.softwareListData.software.isIgnored | Whether this software entry is marked as ignored in the platform. |
| assetListData.asset.softwareListData.software.ignoredReason | Reason provided for ignoring this software entry, if applicable. |
| assetListData.asset.softwareListData.software.category | Combined software category in "Category1 / Category2" format. |
| assetListData.asset.softwareListData.software.category1 | Primary software category (e.g., "Network Application", "Application Development"). |
| assetListData.asset.softwareListData.software.category2 | Secondary software category providing further classification. |
| assetListData.asset.softwareListData.software.productName | Normalized product name of the software. |
| assetListData.asset.softwareListData.software.component | Specific component or module within the software product, if applicable. |
| assetListData.asset.softwareListData.software.publisher | Vendor or organization that publishes the software. |
| assetListData.asset.softwareListData.software.edition | Specific edition of the software (e.g., "Enterprise", "Community"). |
| assetListData.asset.softwareListData.software.marketVersion | Major marketing version of the software as presented to users. |
| assetListData.asset.softwareListData.software.version | Technical version number of the installed software. |
| assetListData.asset.softwareListData.software.update | Specific update or patch version applied to the software. |
| assetListData.asset.softwareListData.software.architecture | CPU architecture the software is built for (e.g., "64-Bit", "32-Bit"). |
| assetListData.asset.softwareListData.software.installDate | Date the software was installed on this asset. |
| assetListData.asset.softwareListData.software.installPath | File system path where the software is installed on the asset. |
| assetListData.asset.softwareListData.software.lastUpdated | Timestamp when this software record was last updated in the platform. |
| assetListData.asset.softwareListData.software.lastUseDate | Timestamp when the software was last actively used on the asset. |
| assetListData.asset.softwareListData.software.language | Language or locale of the software installation. |
| assetListData.asset.softwareListData.software.formerlyKnownAs | Previous name of the software product if it was renamed (e.g., "httpd" for Apache HTTP Server). |
| assetListData.asset.softwareListData.software.isPackage | Whether this software is a package (e.g., an OS package or bundle). |
| assetListData.asset.softwareListData.software.isPackageComponent | Whether this software is a component that belongs to a larger package. |
| assetListData.asset.softwareListData.software.packageName | Name of the parent package this software component belongs to. |
| assetListData.asset.softwareListData.software.productUrl | URL to the official product page or reference documentation for this software. |
| assetListData.asset.softwareListData.software.lifecycle.gaDate | Date the software version became generally available. |
| assetListData.asset.softwareListData.software.lifecycle.eolDate | Date the software version reached end-of-life. |
| assetListData.asset.softwareListData.software.lifecycle.eosDate | Date the software version reached end-of-support. |
| assetListData.asset.softwareListData.software.lifecycle.stage | Current lifecycle stage of the software (e.g., "EOL", "EOL/EOS", "Active", "Unknown"). |
| assetListData.asset.softwareListData.software.lifecycle.lifeCycleConfidence | Confidence level of the lifecycle determination (e.g., "Exact", "Calculated"). |
| assetListData.asset.softwareListData.software.lifecycle.eolSupportStage | Support stage label at end-of-life. |
| assetListData.asset.softwareListData.software.lifecycle.eosSupportStage | Support stage label at end-of-support. |
| assetListData.asset.softwareListData.software.lifecycle.detectionScore | Confidence score for the lifecycle stage detection. |
| assetListData.asset.softwareListData.software.license.category | High-level license category of the software (e.g., "Open Source", "Commercial"). |
| assetListData.asset.softwareListData.software.license.subcategory | Specific license type or SPDX identifier (e.g., "Apache License 2.0", "Free"). |
| assetListData.asset.softwareListData.software.authorization | Authorization status of the software on this asset (e.g., authorized, unauthorized). |
| assetListData.asset.softwareListData.software.discoveredPublisher | Raw publisher name as discovered from the asset, before normalization. |
| assetListData.asset.softwareListData.software.discoveredName | Raw software name as discovered from the asset, before normalization. |
| assetListData.asset.softwareListData.software.discoveredVersion | Raw version string as discovered from the asset, before normalization. |
| assetListData.asset.softwareListData.software.authorizationDetectionScore | Confidence score for the software authorization detection. |
| assetListData.asset.softwareListData.software.cpeId | Internal ID referencing the CPE entry for this software. |
| assetListData.asset.softwareListData.software.cpe | Standardized CPE URI string for the software, used for vulnerability matching. |
| assetListData.asset.softwareListData.software.cpeType | Source or standard for the CPE entry (e.g., "NIST"). |
| assetListData.asset.softwareListData.software.softwareInstances | List of individual installation instances of this software on the asset. |
| assetListData.asset.agent.version | Version of the agent installed on the asset. |
| assetListData.asset.agent.configurationProfile | Name of the configuration profile applied to the agent. |
| assetListData.asset.agent.activations | List of module activations for the agent. |
| assetListData.asset.agent.connectedFrom | IP address or identifier from which the agent last connected. |
| assetListData.asset.agent.lastActivity | Unix timestamp (milliseconds) of the agent's last recorded activity. |
| assetListData.asset.agent.lastCheckedIn | Unix timestamp (milliseconds) of the agent's last check-in with the platform. |
| assetListData.asset.agent.lastInventory | Unix timestamp (milliseconds) when the agent last collected a full inventory. |
| assetListData.asset.agent.udcManifestAssigned | UDC (User-Defined Control) manifest assigned to this agent. |
| assetListData.asset.agent.errorStatus | Current error status of the agent, if any errors are present. |
| assetListData.asset.sensor.activatedForModules | List of platform modules for which the sensor is currently activated (e.g., "VM" for vulnerability management). |
| assetListData.asset.sensor.pendingActivationForModules | List of modules awaiting sensor activation. |
| assetListData.asset.sensor.lastVMScan | Unix timestamp (milliseconds) of the last vulnerability management scan. |
| assetListData.asset.sensor.lastComplianceScan | Unix timestamp (milliseconds) of the last compliance scan. |
| assetListData.asset.sensor.lastFullScan | Unix timestamp (milliseconds) of the last full scan across all modules. |
| assetListData.asset.sensor.lastVmScanDateScanner | Unix timestamp (milliseconds) of the last VM scan performed by a network scanner. |
| assetListData.asset.sensor.lastVmScanDateAgent | Unix timestamp (milliseconds) of the last VM scan performed by the agent. |
| assetListData.asset.sensor.lastPcScanDateScanner | Unix timestamp (milliseconds) of the last policy compliance scan by a network scanner. |
| assetListData.asset.sensor.lastPcScanDateAgent | Unix timestamp (milliseconds) of the last policy compliance scan by the agent. |
| assetListData.asset.sensor.firstEasmScanDate | Timestamp of the first External Attack Surface Management (EASM) scan for this asset. |
| assetListData.asset.sensor.lastEasmScanDate | Timestamp of the most recent EASM scan for this asset. |
| assetListData.asset.container.product | Container platform product name (e.g., "Docker", "containerd"). |
| assetListData.asset.container.version | Version of the container platform running on the asset. |
| assetListData.asset.container.noOfContainers | Number of containers currently running on this asset. |
| assetListData.asset.container.noOfImages | Number of container images present on this asset. |
| assetListData.asset.container.hasSensor | Indicates whether a container sensor is deployed on this asset. |
| assetListData.asset.inventory.source | Discovery source used to build the primary inventory record for this asset (e.g., "IP"). |
| assetListData.asset.inventory.created | Unix timestamp (milliseconds) when the primary inventory record was first created. |
| assetListData.asset.inventory.lastUpdated | Unix timestamp (milliseconds) when the primary inventory record was last updated. |
| assetListData.asset.inventoryListData.inventory.source | Discovery source for this inventory entry (e.g., "Cloud Agent", "IP Scanner"). |
| assetListData.asset.inventoryListData.inventory.created | Unix timestamp (milliseconds) when this inventory source entry was first created. |
| assetListData.asset.inventoryListData.inventory.lastUpdated | Unix timestamp (milliseconds) when this inventory source entry was last updated. |
| assetListData.asset.activity.source | Source that recorded the most recent activity for this asset. |
| assetListData.asset.activity.lastScannedDate | Unix timestamp (milliseconds) of the most recent scan of this asset. |
| assetListData.asset.tagList.tag.tagId | Unique identifier of the tag applied to this asset. |
| assetListData.asset.tagList.tag.tagName | Display name of the tag applied to this asset. |
| assetListData.asset.tagList.tag.foregroundColor | Foreground (text) color of the tag as an integer-encoded RGB value. |
| assetListData.asset.tagList.tag.backgroundColor | Background color of the tag as an integer-encoded RGB value. |
| assetListData.asset.tagList.tag.businessImpact | Business impact level associated with this tag. |
| assetListData.asset.tagList.tag.criticalityScore | Criticality score associated with this tag, used in risk calculations. |
| assetListData.asset.serviceList.service.name | Internal service name as registered in the operating system (e.g., "TermService"). |
| assetListData.asset.serviceList.service.description | Human-readable description of the service's function. |
| assetListData.asset.serviceList.service.status | Current runtime status of the service (e.g., "started", "stopped"). |
| assetListData.asset.lastLocation.city | City where the asset was last detected based on IP geolocation. |
| assetListData.asset.lastLocation.state | State or province where the asset was last detected. |
| assetListData.asset.lastLocation.country | Country where the asset was last detected. |
| assetListData.asset.lastLocation.name | Full formatted location string combining city, state, and country. |
| assetListData.asset.lastLocation.continent | Continent where the asset was last detected. |
| assetListData.asset.lastLocation.postal | Postal or ZIP code of the asset's last detected location. |
| assetListData.asset.criticality.score | Criticality score assigned to the asset, used to prioritize remediation efforts. |
| assetListData.asset.criticality.isDefault | Indicates whether the criticality score is system-assigned (default) or manually set. |
| assetListData.asset.criticality.lastUpdated | Timestamp when the criticality score was last updated. |
| assetListData.asset.processor.description | Descriptive string identifying the CPU family, model, and stepping. |
| assetListData.asset.processor.speed | Clock speed of the processor in MHz, if detected. |
| assetListData.asset.processor.numCPUs | Total number of logical processors on the asset. |
| assetListData.asset.processor.noOfSocket | Number of physical CPU sockets on the motherboard. |
| assetListData.asset.processor.threadsPerCore | Number of hardware threads per CPU core (hyperthreading factor). |
| assetListData.asset.processor.coresPerSocket | Number of physical cores within each CPU socket. |
| assetListData.asset.processor.multithreadingStatus | Indicates whether multithreading (hyperthreading) is enabled or disabled on the processor. |
| assetListData.asset.riskScore | Overall risk score calculated for the asset based on vulnerabilities, criticality, and exposure. |
| assetListData.asset.missingSoftware | List of software that is expected on this asset but was not detected. |
| assetListData.asset.domain | Domain name the asset belongs to. |
| assetListData.asset.subdomain | Subdomain associated with the asset, if applicable. |
| assetListData.asset.whois | WHOIS registration data for the asset's domain or IP address. |
| assetListData.asset.organizationName | Name of the organization associated with this asset. |
| assetListData.asset.isp | Internet Service Provider (ISP) serving this asset's IP address. |
| assetListData.asset.asn | Autonomous System Number (ASN) associated with this asset's IP address. |
| assetListData.asset.hostingCategory1 | Primary hosting classification for the asset (e.g., "Cloud", "On-Premise"). |
| assetListData.asset.easmTags | Tags assigned by the External Attack Surface Management module. |
| assetListData.asset.customAttributes | User-defined key-value attributes assigned to this asset. |
| assetListData.asset.passiveSensor | Details about a passive sensor monitoring this asset, if applicable. |
| assetListData.asset.businessInformation | Business context metadata associated with the asset (e.g., owner, department). |
| assetListData.asset.assignedLocation | Manually assigned physical or logical location for the asset. |
| assetListData.asset.businessAppListData | List of business applications associated with this asset. |
| assetListData.asset.softwareComponent | Software component details if the asset is part of a larger application stack. |
| assetListData.asset.provider | Service provider or platform managing this asset. |
| assetListData.asset.cloudProvider | Cloud provider hosting this asset (e.g., "AWS", "Azure", "GCP"). |
| assetListData.asset.userAccountListData.userAccount | List of user accounts detected on this asset. |
| assetListData.asset.lparId | Logical partition identifier for assets hosted on mainframe or virtualized environments. |