Appearance
Inventory Detail
The inventory detail page provides a comprehensive view of all data collected from a specific asset. It includes inventory records, dataset groupings, snapshot history, change tracking, collection runs, and record relations.
Accessing Inventory Detail
Navigate to the inventory detail page by:
- Clicking an asset name in the inventory list
- Clicking the view button next to an asset in the inventory list
The breadcrumb shows Inventory > [Asset Name].
Summary Cards
At the top of the page, four summary cards provide an overview:
| Card | Description |
|---|---|
| Dataset Types | Number of distinct dataset types collected (e.g., InstalledPackage, SecurityPolicy) |
| Records | Total number of inventory records across all datasets |
| Snapshots | Total number of snapshots received from this asset |
| Last Sync | Time since the most recent data collection. Color-coded: green (within 2 hours), yellow (within 24 hours), red (older than 24 hours) |
Tabs
The detail page is organized into six tabs:
Records Tab
The Records tab displays all inventory records for the asset.
Filter by dataset type: Use the dropdown at the top to filter records to a specific dataset type (e.g., only InstalledPackage records).
Each record shows:
| Column | Description |
|---|---|
| Dataset | The dataset type tag |
| Name | The display name or record key |
| Record Key | The unique identifier (monospace font) |
| OS Family | The operating system family |
| Source | How the data was collected |
| Confidence | Data quality score as a percentage. Green (90%+), yellow (70-89%), red (below 70%). |
| Collected | When this record was last collected |
| Status | Active or Deleted |
Expand a record: Click the expander arrow on any row to view the Normalized Data: the full structured JSON data for that record. This is the data that rulesets evaluate when checking security configurations.
Dataset Groups Tab
The Dataset Groups tab shows a summary of each dataset type collected for this asset.
| Column | Description |
|---|---|
| Dataset Type | The type of data (e.g., InstalledPackage, SecurityPolicy) |
| Records | Number of records in this dataset |
| Source | How the data was collected |
| Confidence | Aggregate data quality score |
| Collected | When this dataset was last collected |
Snapshots Tab
The Snapshots tab shows the history of all inventory snapshots received from this asset.
| Column | Description |
|---|---|
| Version | The snapshot version number (e.g., v1, v2, v3) |
| Type | Full (green) or Delta (yellow) |
| Records | Number of records in this snapshot |
| Hash | Integrity hash (truncated for display) |
| Snapshot Time | When the snapshot was created |
INFO
The first snapshot is always a Full snapshot. Subsequent snapshots are typically Delta snapshots containing only changes, unless a full re-collection was requested.
Changes Tab
The Changes tab tracks all modifications detected between snapshots.
Filter by dataset type: Use the dropdown to focus on changes in a specific dataset.
| Column | Description |
|---|---|
| Type | Change type badge: Added (green), Removed (red), Modified (yellow) |
| Dataset | The dataset type |
| Record Key | Which record changed |
| Changed Fields | Tags listing the specific fields that were modified |
| Summary | A brief description of the change |
| Detected | When the change was detected |
TIP
Use the Changes tab to investigate when a security-relevant configuration changed. If a finding transitioned from Pass to Fail, check the changes tab for the corresponding time period to identify what inventory data changed.
Collection Runs Tab
The Collection Runs tab shows the history of data collection operations performed by the sensor.
| Column | Description |
|---|---|
| Status | Success (green), Partial (yellow), Failed (red), Running (blue) |
| Mode | Collection mode: Full or Delta |
| Datasets Collected | Number of datasets successfully collected vs. requested |
| Agent Version | The sensor version that performed the collection |
| OS | The operating system family |
| Duration | How long the collection took |
| Started | When the collection run started |
| Error | Error summary if the collection encountered issues |
Relations Tab
The Relations tab shows relationships between inventory records, such as a package being associated with a specific service, or a user being a member of a group.
| Column | Description |
|---|---|
| From | The source dataset type and record key |
| Relation | The type of relationship (e.g., "MemberOf", "DependsOn", "RunsAs") |
| To | The target dataset type and record key |
| Collected | When this relation was detected |
INFO
Relations are populated after a full inventory sync. They help AttackLens understand dependencies between system components and are used by the attack graph for modeling.
Quick Actions
- View Asset: Link in the page header to navigate to the asset detail page
Related Pages
- Understanding Inventory: How inventory collection works
- View Inventory: Browse inventory across all assets
- Sensors: Manage the agents that collect data
- Understanding Findings: How inventory data drives security findings