Asset Library¶

Audience: All client users (creating/editing assets is typically a manager/owner action) · Where: Asset Library in the sidebar (/assets).

Overview¶

The Asset Library is the inventory of everything Canima knows about your attack surface — domains, IP addresses, and web applications. It's the single source of truth that assessments point at: when you launch a test, you pick its target from here. Assets arrive two ways:

Manually

You add them yourself with + Add Asset.
ASM Discovery

Found automatically by attack-surface monitoring.

Attack Surface

The asset list¶

Summary tiles count Total / Web App / Internal / External assets. Below, each row is described by these columns:

Column	What it shows
Value	The domain, IP, or URL. A parent (e.g. a TLD) can have children — subdomains and related IPs — expandable with the ▸ arrow. An N children badge shows the count, and an N dns badge shows how many hostnames/IPs it resolves to or from.
Category	External / Internal / Web App.
Type	TLD, Domain, IP Address, URL, API Endpoint, Hostname, CIDR, Service, DNS Hostname, Certificate, or Dork Result.
Status	`active`, `inactive`, `new`, `changed`, or pending approval (see below).
Source	Where it came from: Manual, ASM Discovery, Scan Discovery (found during an assessment scan), or Import.
Last Seen	When it was last observed.

Every column is sortable — click a header to cycle ascending/descending. Use the All / Web App / Internal / External tabs (or click a summary tile) and the Filter assets box to narrow the list; if your org uses Tags, a chip bar lets you filter by one or more tags. The pencil/trash icons on a row edit or remove a single asset, and managers/owners can tick several rows and Delete them in bulk.

Pending approval

Some discovered assets arrive as pending and show a Pending badge plus a banner counting how many await approval. An admin clicks the badge to approve an asset into your inventory.

Adding an asset¶

Click + Add Asset and fill in:

Asset Category (External / Internal / Web App) and Asset Type (IP Address, URL, …) — the available types adjust to the category you pick.
Value — the actual address (e.g. 198.51.100.10 or https://app.example.com).
Optional Display name, Location, Description, and Tags.

For a Web App asset you also see an Application complexity section — an optional Distinct user roles count plus checkboxes for multi-tenant / cross-tenant isolation and handles cardholder data (CHD) or PHI. As you fill these in, a live badge shows how many license slots the app will use when registered:

Complexity	License slots
Standard	1 slot
Complex (multi-tenant isolation or CHD/PHI)	2 slots
Enterprise (6+ roles)	Needs sales to set up

See Licenses & Credits for the seat model.

Click Add Asset to save. The new asset immediately becomes available as a target when creating an assessment.

Tags¶

Tags group and label assets (by environment, business unit, owner, criticality — whatever suits you). Create and manage them from Manage tags, or add tags inline while creating/editing an asset. Tags then work as filters across the library.

Asset detail¶

Click any asset to open its detail page. The header shows Asset Details (First/Last Seen, Source, Status, and monitoring state) and a Metadata panel, and each of these detail sub-tabs shows a live count:

Services

Open ports and services.
Vulnerabilities

Vulnerabilities detected on this asset.
Findings

Issues tied to this asset.
Software

Detected products/versions.
Recurrence

How findings and vulnerabilities for this asset have recurred across engagements.

For an IP or DNS hostname you also get a DNS Resolutions panel, and a parent asset lists its child assets in a table. A Record Information card at the bottom shows when the asset was created and last updated. This is the per-asset drill-down — everything discovered about that one host or app in one place.

Registering a web application for testing¶

Web-application testing uses a seat model: to test a web app, it must be registered into an application slot from your allocation. Registration is done from the web-app asset (or during the Create Assessment wizard when you pick the target). A single app normally holds one slot; more complex apps (many roles, multi-tenant isolation, or those handling cardholder/health data) may hold two. Releasing a slot frees it for another app.

Because slots come from your license allocation, registering and releasing apps is usually a manager/owner action — see Licenses & Credits for how slots and quota work.

Tips¶

Get the most from your library

Keep the library current — assessments can only target assets that exist here, and accurate scope (including secondary hosts) improves coverage.
Let ASM Discovery do the heavy lifting for external assets; add internal hosts and specific web apps manually.
Use Tags to slice Analytics and Findings by the groupings that matter to your organization.