-
-
Notifications
You must be signed in to change notification settings - Fork 0
Customer Asset Registry
Case assets live inside their case; the same laptop in five cases is five unrelated
rows. Since IRIS-NG-v2.0.0, a persistent registry per customer makes a host one
entity across every case and alert it ever appeared in — filled in automatically from
ordinary work, curated by analysts, and never in the write path's way.
The registry lives in the sidebar under Manage.
An asset's registry identity is (customer, normalised name, type). Names are
matched case-insensitively with surrounding whitespace trimmed — and nothing else:
host and host.corp.local are deliberately different machines, because collapsing
them would guess at network topology the analyst never asserted. First-seen casing is
what displays.
Registry sync runs on the paths where assets already enter the product: creating a case asset (any modal or API), editing one, escalating or merging an alert, promoting a working-timeline observation, and importing a case. Alert ingest syncs the alert's embedded assets too.
Sync is deliberately unintrusive:
- It never blocks or fails the operation that triggered it. A registry problem is recoverable later by scan; a lost case write is not.
- Scan cases (administrators) backfills the whole registry from existing history in one pass — the recovery tool and the day-one bootstrap.
The fields you set by hand — criticality, environment, owner, notes — are yours; sync fills only what is unset. Compromise status has one extra rule worth trusting:
Sync only ever raises compromise status from unknown / to be determined. An analyst's explicit verdict — including an explicit not compromised — is never overwritten by automation. Deciding a machine is clean is analysis, not data entry.
Every change lands in a per-asset change log, so "when did this become critical, and who said so" is answerable across the whole registry.
An asset's sightings — every case and alert it appeared in — are computed live, not stored, so they are correct the moment you look. They are filtered to what you can see, with an explicit count of what was withheld: a short list is labelled as bounded by your access, never passed off as complete.
Overview (with inline editing) · Sightings · Timeline — the master-timeline events the asset is linked to, access-filtered like sightings · Changes — the audit log. IP, domain and tags in the overview are live-derived from the newest matching case observation, so the registry shows what was seen most recently rather than a stale copy.
The list offers text search plus tri-state Seen and Compromised filters — "compromised: no" means an explicit verdict, not merely the absence of one.
Export from the list; import (administrators) resolves customer and type by name and reports per-row errors rather than failing the file wholesale — row 40 being wrong doesn't cost you rows 1–39.
Reading and curating are scoped to the customers you can already see; delete, scan and CSV import are server-administrator actions. No new permission bits — the registry rides the access model you already manage.