Identify and Classify Assets
Two servers carry the same critical vulnerability. One runs your payment application. The other is a test machine someone forgot to switch off. Which one do you fix first?
ETM can answer that question for you, but only if it knows what each asset is and what it means to your business. That is what identifying and classifying your assets does. It turns a long list of discovered hosts into an inventory where the assets that matter most rise to the top of your TruRisk™ view.
Navigate to: Inventory > Assets
Use this to
- Know what each discovered asset is and where it came from.
- Pick the right classification method for each group of assets.
- Build a classification that updates itself as your environment changes.
- Confirm that your most important assets carry the highest risk scores.
Where this fits
1. Discover → 2. Identify → 3. Classify → 4. Prioritize
You are here: steps 2 and 3. Discovery fills your inventory. Identification and classification give each asset meaning. TruRisk™ then uses that meaning to rank what to fix first.
Before you begin: Asset inventory data comes from CSAM. Make sure your CSAM subscription is active and that at least one discovery source, such as a scan, a cloud agent, or a connector, is reporting assets. For more information, see Discover Asset Inventory.
What Do You Want to Do?
Jump straight to the method that matches your goal.
| I want to… | Use | Go to |
|---|---|---|
| See what kinds of assets I have | Grouping by hardware or operating system on the Assets tab | View Asset Inventory |
| Stop the same host from appearing twice | Asset identification and reconciliation rules | Asset Deduplication and Reconciliation |
| Label a handful of specific assets | A static tag | Create Tags |
| Label every asset that matches a pattern, now and in the future | A dynamic tag | Create Tags |
| Combine tags, or leave some assets out | A tag set | Create Tag Sets |
| Tell ETM how important an asset is | An Asset Criticality Score (ACS) on a tag | Asset Criticality Score Recomputing |
| Score assets I have not tagged yet | AI ACS | Asset Criticality Score Prediction by AI |
| See assets by the service or company they support | Business entities, business apps, and organizations | View All Defined Business Entities |
Step 1: Identify Your Assets
Identification answers three questions about every record in your inventory.
| Question | How ETM answers it |
|---|---|
| What is it? | ETM catalogs network hosts, IP assets, cloud instances, software, web applications, network services, and certificates. The Assets tab shows each host's identity, running services, installed software, open ports, and users. |
| Where did it come from? | Each asset lists the sources that reported it, such as active scanning, Cloud Agent, cloud connectors, or external integrations. |
| Is it already in Qualys? | Asset identification rules compare the attributes you select, such as IP and MAC address, to decide whether an asset from a third-party source matches one Qualys already knows. See View or Create Asset Identification Rules. |
Step 2: Classify Your Assets
Classification tells ETM what each asset means to you. You have three building blocks, and they work best together.
| Building block | What it gives you |
|---|---|
| Tags and tag sets | Groups. Tags label assets so you can find, filter, and control access to them. Tag sets combine tags into larger groups. |
| Asset Criticality Score | A rank. A score from 1 to 5 set on a tag tells ETM how important the tagged assets are to your business. |
| Business context | Meaning. Business entities, business apps, and organizations or subsidiaries show which service or company each asset supports. |
Static or Dynamic? Pick the Right Tag
| Static tag | Dynamic tag | |
|---|---|---|
| How it is applied | You apply it to assets yourself. | A rule applies it to every asset that matches. |
| New assets | Stay untagged until you tag them. | Are tagged as soon as they match the rule. |
| Best for | A small, fixed set of assets you can name, or a score you want to keep fixed until you change it. | Assets you can describe by a property that can change, such as operating system, IP range, open ports, or business information. |
How the Criticality Score Works
- No score on the tag? The asset gets the default score of 2.
- Several tags with different scores? The highest score wins. An asset with tags scored 3, 4, and 2 has an asset criticality score of 4.
- No tag at all? AI ACS can predict a score for untagged assets, so that no asset is left out.
Example: Put Your Payment Servers First
Say your payment application runs on hosts whose names contain pay-. Here is how to make sure ETM treats them as your most important assets.
- Find them. On Inventory > Assets, run a QQL query to list the hosts and confirm the naming pattern holds. For query syntax, see Search Tokens for Assets.
- Tag them. Go to Tags, and select Tag from the Create New list. Name the tag, for example Payment Servers, and set the Asset Criticality Score to 5.
- Make it dynamic. Select Dynamic as the tag type, choose the Asset Name Contains rule, and enter pay-.
- Test before you apply. Use Test Rule Applicability on Selected Assets on a few hosts you know. Pass means the host matches the rule.
- Apply it. Select Evaluate Rule on Creation, and click Create.
- Check the result. Back on the Assets tab, the payment hosts now show an asset criticality score of 5. Click Recalculate Score if you want the TruRisk™ score to update right away.
Every new host named pay- that joins your inventory from now on gets the same tag and score automatically.
A dynamic rule that matches more assets than you expect also gives its criticality score to all of them. Always test the rule on known assets before you select Evaluate Rule on Creation.
Build Your Full Classification
Ready to classify the rest of your inventory? Work through these steps.
- Survey the inventory. On the Assets tab, use the bar charts, the left pane counts, and the grouping categories to see which asset types, operating systems, and hardware you have.
- List what matters most. Decide which groups of assets are most important to your business, and give each group a score from 1 (lowest) to 5 (highest).
- Create one tag per group. Use a dynamic tag wherever you can describe the group with a rule, and a static tag for the rest. See Create Tags.
- Apply your static tags. On the Assets tab, select the assets and add the tag from the Quick Actions menu.
In a single operation, you can add tags to a maximum of 10,000 assets.
- (Optional) Combine tags into tag sets. Include up to 20 tags and exclude up to 20 tags per set. Tag sets are available for CSAM subscriptions only. See Create Tag Sets.
- Add business context. Define your business entities, and review the business apps and organizations or subsidiaries your assets belong to. See View All Defined Business Entities, View Business Apps, and View Organization/Subsidiary.
- (Optional) Fill the gaps with AI ACS. Enable AI ACS in the CSAM application so that untagged assets still receive a criticality score. See Asset Criticality Score Prediction by AI.
You Are Done When
- Each host appears once in your inventory.
- Your most important assets carry a criticality score of 4 or 5.
- New assets are picked up by a dynamic tag, or by AI ACS if they are untagged.
- Your assets are linked to the business entities and apps they support.
- The assets at the top of your TruRisk™ view are the ones you would fix first.
See the Effect on TruRisk™
Every classification change flows through to the criticality score, and from there to three levels of your risk view:
| Level | What changes |
|---|---|
| Asset | Criticality status of the individual asset. |
| Business entity | Aggregated criticality for all assets within the business entity. |
| Organization | Organization-wide criticality on the overall risk dashboard. |
Scores recalculate automatically every couple of hours. Click Recalculate Score to update them sooner. A manual recalculation completes in approximately 15 minutes.
Best Practices
Follow these practices to keep your classification accurate and your TruRisk™ view focused on the assets that matter most.
| Best practice | Why it matters |
|---|---|
|
Deduplicate before you classify. Set up identification and reconciliation rules first. |
Each host keeps one record, one classification, and one risk score, so its risk is not counted twice. |
|
Set a score on every tag that marks important assets. Choose a value from 1 to 5 in the Asset Criticality Score field. |
A tag without a score gives its assets the default score of 2, so critical assets blend in with the rest. |
|
Prefer dynamic tags for groups that change. If you can describe a group in one sentence, such as "every Windows server in the 10.20.0.0/16 network", make it a dynamic tag. |
New assets that match the rule are tagged and scored automatically, with no manual work. |
|
Test every rule before you apply it. Use Test Rule Applicability on Selected Assets on hosts you know. |
You confirm the rule matches only the assets you intend, so no unrelated asset gets a higher score. |
|
Cover untagged assets with AI ACS. Contact Qualys support to enable the feature, then turn it on in the CSAM application. |
Assets you have not tagged yet still receive a criticality score, so none are left out of your risk view. |
|
Review your classification regularly. Check the top of your TruRisk™ view after you add tags or business entities. |
You confirm that the assets ranked highest are the ones you would fix first. |