Asset Library¶

Audience: All client users (creating/editing assets is typically a manager/owner action) · Where: Asset Library in the sidebar (/assets).

Overview¶

The Asset Library is the inventory of everything Canima knows about your attack surface — domains, IP addresses, and web applications. It's the single source of truth that assessments point at: when you launch a test, you pick its target from here. Assets arrive two ways:

Manually

You add them yourself with + Add Asset.
ASM Discovery

Found automatically by attack-surface monitoring.

Attack Surface

The asset list¶

Four summary tiles count Total Assets / Web App Assets / Internal Assets / External Assets across your whole organization. Click a tile to filter the table to that category (click Total Assets to clear it).

Each row is one top-level asset. Click a row to open its detail page; child assets (subdomains and related IPs under a parent such as a TLD) are listed there rather than expanded inline. The table has these columns:

Column	What it shows
Asset	The domain, IP, or URL, with its tags. Badges add context: N children (how many child assets sit under it), N dns (how many hostnames/IPs it resolves to or from), and a scope badge (below).
Category	External / Internal / Web App.
Type	TLD, Domain, IP Address, URL, API Endpoint, Hostname, CIDR, Service, DNS Hostname, Certificate, or Dork Result.
Status	`active`, `inactive`, `new`, `changed`, or pending approval (see below).
Source	Where it came from: Manual, ASM Discovery, Scan Discovery (found during an assessment scan), or Import.
First seen	When it was first observed.
Last seen	When it was last observed.

Finding the assets you want¶

Search assets… — free-text search. Searching (or filtering by tag) also matches child assets, not just top-level ones.
Category filter — External / Internal / Web App.
Tags filter — appears once your organization has tags; shows assets carrying any of the selected tags.
Show ignored — switches the table to assets your team has ignored (see Attack Surface). Ignored assets are hidden from the library, never scanned, and excluded from pentests. Managers and owners can Stop ignoring one from the Ignored column.
Sort by clicking a column header, choose visible columns, and Export CSV to download the filtered list.

Members can edit an asset's name and notes from the pencil icon on its row. Managers and owners can also delete a single asset, or tick several rows and Delete them in bulk.

Scope badges¶

Discovered assets can carry a badge describing whether they look like they belong to you:

Badge	Meaning
In scope (owned)	The asset appears to be yours.
Review scope	Ownership is unclear — confirm before testing it.
3rd-party hosted	The asset is hosted by a third party (for example a SaaS or CDN provider). Hover the badge for the reasons.

Discoveries awaiting review

New assets found by attack-surface monitoring don't go straight into the library. When some are waiting, a banner reads "N discovered assets awaiting review" — click Review to triage them on Attack Surface → Discovery.

Pending approval

Some assets arrive as pending and show a Pending badge plus a banner counting how many await approval. An admin clicks the badge ("Click to approve") to approve an asset into your inventory.

Adding an asset¶

Click + Add Asset and fill in:

Asset Category (External / Internal / Web App) and Asset Type (IP Address, URL, …) — the available types adjust to the category you pick.
Value — the actual address (e.g. 198.51.100.10 or https://app.example.com).
Optional Display name, Location, Description, and Tags.

For a Web App asset you also see an Application complexity section — an optional Distinct user roles count plus checkboxes for multi-tenant / cross-tenant isolation and handles cardholder data (CHD) or PHI. As you fill these in, a live badge shows how many license slots the app will use when registered:

Complexity	License slots
Standard	1 slot
Complex (multi-tenant isolation or CHD/PHI)	2 slots
Enterprise (6+ roles)	Needs sales to set up

See Licenses & Credits for the seat model.

Click Add Asset to save. The new asset immediately becomes available as a target when creating an assessment.

Tags¶

Tags group and label assets (by environment, business unit, owner, criticality — whatever suits you). Create and manage them from Manage tags, or add tags inline while creating/editing an asset. Tags then work as filters across the library.

Asset detail¶

Click any asset to open its detail page. The header shows four quick stats — Open services, Critical / high open, Monitoring (its attack-surface monitoring state), and Last seen — alongside its source, status and a Metadata panel. Members can click Edit to change the name and notes; for assets you added manually, managers and owners can also change the category, type, and (for web apps) the application complexity. Discovered assets keep the category and type the platform assigned.

Below the header, sub-tabs each show a live count:

Services

Open ports and services (port, service, product, first/last seen). Show closed services includes ones that have since closed.
Vulnerabilities

Vulnerabilities detected on this asset.
Findings

Issues tied to this asset, filterable Open / Closed / All.
Software

Detected products/versions.
Recurrence

How findings and vulnerabilities for this asset have recurred across engagements.
Timeline

Alerts, service changes, and findings for this asset, in time order.

For an IP or DNS hostname you also get a DNS Resolutions panel. For a hostname it lists what it Resolves to and what it Previously resolved to; for an IP it lists the Hostnames pointing here and those that Previously pointed here. A monitored resolution that holds an attack-surface slot has a Release action to free the slot.

A parent asset lists its Child Assets in a table, and a Record Information card at the bottom shows when the asset was created and last updated. This is the per-asset drill-down — everything discovered about that one host or app in one place.

Registering a web application for testing¶

Web-application testing uses a seat model: to test a web app, it must be registered into an application slot from your allocation. Registration is done from the web-app asset (or during the Create Assessment wizard when you pick the target). A single app normally holds one slot; more complex apps (many roles, multi-tenant isolation, or those handling cardholder/health data) may hold two. Releasing a slot frees it for another app.

Because slots come from your license allocation, registering and releasing apps is usually a manager/owner action — see Licenses & Credits for how slots and quota work.

Tips¶

Get the most from your library

Keep the library current — assessments can only target assets that exist here, and accurate scope (including secondary hosts) improves coverage.
Let ASM Discovery do the heavy lifting for external assets; add internal hosts and specific web apps manually.
Use Tags to slice Analytics and Findings by the groupings that matter to your organization.