Assets & Discovery

What it is

CMDash keeps two different views of your estate side by side, deliberately unmerged. Asset Inventory is your hand-curated list of what matters — the crown-jewel assets that feed FAIR's value derivation and the Maturity workspace's crown-jewel weighting. Asset Reconciliation is the opposite: a host list built automatically from every connected EDR, vulnerability scanner, and MDM, whose real value is showing you where those sources disagree. SaaS Discovery does the same job for applications instead of hosts, surfacing software your workforce is using that was never linked to a vendor record. Estate Diff watches the reconciled estate over time and reports what changed since the last run. Coverage Trend tracks where each coverage percentage has been, where it's headed, and whether it will hit a target you set.

When to use it

Use Asset Inventory to maintain the assets that matter for risk scoring and FAIR quantification — it's a lightweight, manually-owned list, not a discovery feed. Use Asset Reconciliation and SaaS Discovery when you want the estate to tell you what exists, rather than relying on someone remembering to add it. Use Estate Diff after you've reconciled at least once, to catch hosts that appeared, disappeared, or stopped reporting since your last check. Use Coverage Trend when a stakeholder — a board, an auditor — asks not just "what's your coverage today" but "is it getting better."

Before you start

How to

Maintain your curated inventory

1. Go to Security → Asset Inventory and click New asset.
2. Assets carrying a NIST CSF function feed the Maturity workspace's crown-jewel weighting — set that field if the asset matters to your maturity scoring, not just your records.
3. Record or edit assets as your estate changes. This list is not synced from an integration — it's the set you've deliberately chosen to track.

Reconcile hosts from your connected tools

1. Go to Security → All Security tools → Asset Reconciliation. The page states its purpose directly: "One host list built from every connected EDR, vulnerability scanner and MDM — and, more usefully, the hosts they disagree about."
2. Click How matching works to see the match rules the reconciliation engine uses to decide two sightings are the same host, and Source precedence to see (and reorder) which connected source wins when sources disagree about a field.
3. Click Reconcile now to run the join. CMDash reports how many sightings were processed and from how many of your connected sources, flagging any source it skipped as stale.
4. Click Curated inventory to jump back to Asset Inventory. It's a plain navigation link, not a promote action — nothing is copied automatically; add a reconciled host to your hand-maintained list the same way you'd add any other asset there.

Find ungoverned SaaS applications

1. Go to Security → All Security tools → SaaS Discovery. This reads from IdP sign-in logs and expense data to surface applications your workforce is actually using that were never linked to a vendor record or TPRM assessment.
2. Click Sync IdP sources to pull the latest sign-in-based signal, or Upload expense CSV to add spend-based signal CMDash can't get from your IdP alone.
3. For an application that isn't a real governance gap (a personal tool, a false match), click Dismiss and give a reason when prompted — dismissed apps are excluded from the count going forward, but the reason is kept for the record.

Track what changed in your estate

1. Go to Integrations → Estate Diff and click Run Now.
2. CMDash reports new hosts, hosts that disappeared, sources that stopped reporting, and coverage drops since the last run — expand any entry for detail.

Watch coverage trend and set targets

1. Go to Security → All Security tools → Coverage Trend. Each of the three estate-coverage categories — EDR, Vulnerability Scanning, MDM Enrollment — gets its own card showing history and a forecast of whether it's tracking toward a target. (The equivalent trend for people, not hosts, lives on Identity Coverage — see Access Reviews & Identity Coverage.)
2. Click the edit control on a category to set or clear a target percentage; save it to see the forecast measured against that goal instead of just the raw trend line.

Read group coverage across business units and subsidiaries

1. Go to Security → Coverage Scorecard. The top shows the group total, then business units, then subsidiaries, each with EDR, Vulnerability Scanning and MDM Enrollment as percent and numerator of denominator. The group figure is recomputed from the summed counts, not an average of the entity percentages.
2. An entity that was never measured reads Not measured, and each total says how many entities it does not cover. Never measured is unknown, not zero.
3. Click Show sources on an entity for each category's source count, stale sources and the time it was measured.

Import scan results from a file

1. Go to Import scan results and choose a SARIF report, a CycloneDX or SPDX SBOM, or a CSV with control_id and framework columns. The format is detected from the content, not the filename.
2. Optionally name the feed (for example nightly-semgrep). Uploading the same scan again under the same name updates its rows instead of duplicating them.
3. Click Preview: it runs the same mapping as the commit and writes nothing, and shows how many observations and evidence records would be written. Click Commit this import to write them.

Common questions

Why are there two host lists — Asset Inventory and Asset Reconciliation? They serve different jobs on purpose: Asset Inventory is hand-curated and answers "what do we consider a crown-jewel asset," while Asset Reconciliation is discovered and answers "what does our tooling actually see, and where does it disagree." CMDash does not merge or promote between them automatically — the reconciliation API has a link-inventory route, but no page calls it today, so moving a reconciled host into your inventory means re-entering it there by hand.

Does dismissing a SaaS application in SaaS Discovery remove it everywhere? It stops counting toward SaaS Discovery's open findings; it does not delete any underlying sign-in or expense data, and the reason you gave is retained.

Can a VIEWER see Asset Reconciliation or Estate Diff? Yes — viewing on both pages has no role restriction, so any authenticated member (including VIEWER) can view them on a Command+ tenant. Only the mutating actions (reconcile/sync, override, merge, link, run a diff) are restricted to OWNER/ADMIN.

How does a SaaS app become "Governed"? Only by being linked to a Vendor record with a clean assessment — CMDash never flips the status by hand. The API supports linking a discovered app to a vendor, but no button on the SaaS Discovery page calls it today; Dismiss is the only action available there. See "Limits" below.

Limits: there is no page that shows Asset Inventory and Asset Reconciliation side by side in one reconciled diff view — cross-referencing the two today means opening both pages. There is also no button to link a discovered SaaS app to a Vendor record from the SaaS Discovery page, even though the underlying API endpoint exists.

Related

• Compliance Frameworks
• Posture Score
• FAIR Quantification