Assets: every screen, column and action¶
The largest module in the product — 116 columns and 52 row actions across the inventories, the management screens and the queues. Everything below is taken from the templates.
The asset inventories¶
Web, Mobile, Thick Client, Network, API and Container each have their own list. The four application-style inventories share a column set:
| Column | What it holds |
|---|---|
| Application Details / Assets Details | Name, identifier and type |
| Risk Score | The contextual score, not raw severity |
| Project | Which project the asset belongs to |
| Audits / Active Audits | How many assessments exist against it |
| Total | Open findings |
| Critical / High / Medium / Low / Info | The severity split of those findings |
The severity columns are labelled from the severity master, so an organisation that renames or recolours a severity sees the change here without any configuration on this screen.
App Code¶
Every application-style asset carries an App Code — your organisation's own identifier for the application, as used in your CMDB, your change process or your finance system. It is not generated by NxSAM.
It exists so that a finding can be traced back to the system of record everyone else uses. Asset names drift (a portal gets renamed, an acquisition rebrands); the code usually does not, which is why reports, host selections and exports all carry it.
App Code can be made mandatory, and usually should be
A system setting makes App Code required when onboarding an asset. Left optional, it gets skipped during a bulk import and the gap is invisible until someone tries to reconcile findings against the CMDB months later and finds half the estate unmatched.
Turning it on later does not backfill the assets already created without one.
Network assets replace Project with Application Count — how many applications run on the host — because a host's importance follows from what it carries.
API assets replace the severity columns with API Collections Details and Description, since an API asset is a collection of endpoints rather than one deployable thing.
Container assets show Registry / Repository, Org, Vulnerability, Compliance and Collections — the image coordinates instead of a name.
Row actions on an application asset — ten¶
| Action | What it does |
|---|---|
| View Web Application / View Mobile Application / View Thick Client | The asset's full record |
| View Overall Details | Findings and audits across the asset's whole history |
| Edit Web Application / Edit Mobile Application / Edit Thick Client | The asset's own fields |
| Edit Ownership | Who is responsible — drives visibility and chasing |
| Edit Tags | Labels used for grouping and reporting |
| Add/Download Document | Attaches or retrieves supporting files |
| Risk Score Overview | How the score was arrived at, factor by factor |
| Download Overall Report | A report covering everything known about the asset |
| Delete Application | Soft delete |
An asset's type is fixed once it is created
The type decides which module assesses the asset and which scanners can contribute findings to it, so it is set at creation and not changed afterwards. If an asset has been classified wrongly, create it under the correct type rather than looking for a way to move it — findings already recorded stay attached to the asset as it was classified.
Use it to correct a mistake made at onboarding, not to reorganise a working estate.
Risk Score Overview is the answer to "why is this asset ranked above that one". The score combines severity with asset context — criticality, exposure, exploitability — and the overview shows the contribution of each. Without it the ranking is unexplainable to the person being asked to act on it.
Network asset actions¶
Edit Network Asset, Edit Network Asset Owner, Edit Tags, Risk Score Overview, Download Overall Report, Delete Network Asset, and Request VA Audit — which creates a VA audit against the host without leaving the inventory. That last one is the normal path from "this host looks wrong" to "someone is scanning it".
API asset actions¶
View Overall Details, Edit Asset, Edit Ownership, Edit Tags, Risk Score Overview, Download Overall Report, Delete Asset.
Page-level actions on an inventory¶
| Action | What it does |
|---|---|
| Import Hosts | Bulk-creates network assets from a file |
| Update Asset Properties | Sets custom properties across selected assets at once |
| Update Application Tags / Update Host Tags / Update Thick Client Tags | Bulk tagging |
| View Queues | The status of bulk operations started from this screen |
| Generate Application Summary | Per-application summary report |
| Generate Detailed Summary | The long form |
| Generate Issue Dashboard Summary | Findings shaped for a dashboard view |
| Generate Wise Summary | Grouped summary across the inventory |
Bulk updates are queued, and View Queues is where they report
Updating properties or tags across a selection does not complete when the dialog closes. It queues, and the result — including rows it could not apply to — appears under View Queues.
A bulk update that "did not work" has usually finished with rejections nobody read.
Asset detail views¶
Opening an asset shows its audits:
Latest audit details — Audit Details, Start Date, Audit status, Audit testing
methodology, Audit type, Type / Methodology, Audit Considered.
Active audit details — ID, Audit Name, Start Date, Audit status, Audit type,
Audit Cycle.
Audit Considered on the latest-audit view is the field that explains a dashboard disagreement: an asset whose most recent audit is not considered contributes its previous audit's numbers to aggregate views.
Overall details for one asset¶
Opened from View Overall Details. It gathers everything known about the asset in one place, across every audit it has ever had:
| Section | What it holds |
|---|---|
| AUDITORS | Everyone who has assessed this asset, from auditors |
| Best Practice | Findings raised as recommendations rather than defects |
| Port / Protocol | For network assets, where each finding was observed |
Best Practice findings are the ones people argue about. They are not vulnerabilities — nothing is exploitable — but a hardening recommendation the assessor considered worth recording. They carry no SLA and should not be counted as an open risk, which is why they are separated here rather than mixed into the finding list.
AUDITORS matters on a re-test dispute. When a finding closed by one assessor is re-opened by another, this is where you see that two different people assessed the same asset — which is frequently the explanation.
Ownership¶
User name and Owner Type, multi-select. An asset can have several owners of different types — a technical owner and a business owner, for instance — and each type is chased differently when findings age.
Ownership is also visibility: an asset owner sees their own assets and the findings on them. A colleague who cannot see an asset you can is an ownership question, not a permissions fault.
The organisational hierarchy¶
| Screen | Columns |
|---|---|
| Organizations | ID, Organization Details, Network asset uniqueness, API asset uniqueness, Status |
| Business Units | ID, Business Unit, Organisation, Created By, Status |
| Projects | ID, Business Unit, Project Details, Organisation, Status |
Asset uniqueness is set per organisation and is hard to change later
Network asset uniqueness and API asset uniqueness decide whether the same host or endpoint can exist twice within an organisation. Set it to unique and a second import of the same IP updates the existing asset; set it to non-unique and it creates a second one.
Changing it after assets exist does not merge or split what is already there. It only changes what the next import does, which is why two environments with the same data can end up with different asset counts.
Asset properties¶
| Screen | Columns |
|---|---|
| Asset Properties | Property Name, Property Type, Created By |
| Asset Property Management | Asset Type, Properties — which properties apply to which type |
| Manage Properties (dialog) | Property Name, Property Type, Sequence, Mandatory |
Mandatory and Sequence are set per asset type. A property marked mandatory blocks asset creation until it is filled, which is the usual reason a bulk import starts rejecting rows after someone edits the property configuration.
Asset owner types¶
ID, Asset Owner Name, Created By, Created On. The catalogue of ownership roles
that can be assigned — technical owner, business owner, and any others your organisation
defines.
Network asset mapping¶
View mapped network asset — ID, Host, Risk Master, Total, Critical, High,
Medium, Low, Info.
Update network assets — Network Asset ID, Host IP/Host Name.
Mapping relates an application to the hosts it runs on, so an application finding can be traced to infrastructure and a host's risk reflects what it carries.
The import and sync queues¶
Four tabs, because assets arrive four ways.
| Tab | Columns |
|---|---|
| AppSec | Name, Workflow, Asset Type, Status, Initiated By, Initiated At, plus Properties, Header, Default Value for the column mapping |
| Network | The same set |
| CMDB | Sync Type, Status, Initiated At, Completed At |
| ServiceNow | ServiceNow Table Name, Asset Sync Type, Network Asset Type, Status, then per-module Module, Status, Initiated At, Completed At, Logs |
The ServiceNow tab filters by All, Appsec Assets or Network Assets, because one sync can populate both and they succeed independently.
Mapping a ServiceNow table¶
A ServiceNow sync is configured per table: which of its records to take, which of its fields feed which NxSAM property, and how to translate values on the way in. The mapping screen has five tools, and most "the sync imported the wrong thing" questions are one of them set wrongly.
| Tool | What it does |
|---|---|
| Header Mapping | Pairs each NxSAM Property with a ServiceNow Field. Click a field cell to pick from the table's own fields; Fetch a sample lists them with a Sample Value each, and marks a SUGGESTED match where the names line up. A Static property takes a fixed Default instead of a field |
| Reference fields | A field marked REF points at another record. The mapping asks which attribute of the linked record to store — its display value, or a specific attribute — rather than the raw reference |
| Fallback fields | A property can read from an ordered list of fields; the first non-empty one wins. Where every field in the list is empty, the property's own default applies |
| Where Condition | Filters which records sync, per property: match ALL or ANY of a set of conditions, each a Match or No match. It can be tested against live data before saving |
| Value Mapping | Translates a field's source values into NxSAM values for choice-type properties, so a value ServiceNow spells one way lands as the option NxSAM recognises. The source side offers the values actually present in the column, and accepts a typed value for ones not yet seen |
Data Preview shows what the mapping would produce — the Resolved values for a page of records, with VISIBLE and HIDDEN columns and a search — and can export it, with the time of the Last export shown. Preview before the first sync, and again after any change to a where condition or value mapping: a sync that imports ten thousand rows is much harder to undo than a preview that shows ten.
A fallback chain is why a field can be populated from a column nobody mapped
When the first field in a chain is empty, the sync reads the second, then the third. An asset whose IP "came from the wrong place" usually has an empty primary field and a populated fallback — which is the chain working as designed. Check the chain before checking the data.
For application assets, the sync can Auto-Create Application records for CIs with no match, Auto-Generate App Code where the source has none, and Auto-Update Empty App Code on records that already exist without one. Each is a switch on the sync setting, off by default, because each one creates or changes records rather than merely reading them.
Header and Default Value in the file-based tabs are the column mapping: which column of the uploaded file feeds which property, and what to use when it is empty. A default value quietly applied to thousands of rows is a common source of "why do all our assets say the same thing".
Decommissioning¶
| Column | What it holds |
|---|---|
| Decommission Asset ID | The request |
| Initiator | Who raised it |
| Status | Where the request has got to |
| Pending On | Who it is waiting for |
Actions: Edit Decommission, Update Initiator, View Status History, Delete Decommission Request.
Decommissioning is a request with an approval chain rather than a delete, because removing an asset from tracking changes historical reporting. Pending On is what you check when a request has stalled.
The selection screens list Assets, Asset Type, Organisation, Business Unit,
Project so the right assets are chosen before the request is raised.
Audit Calendar Planner¶
Plans assessments across the estate so coverage is deliberate.
| Column | What it holds |
|---|---|
| Planner Details / Description | The plan |
| Created By / Updated On | Provenance |
| Selected Assets & Audit Type | What is planned against what |
| Assets | How many are in the plan |
| Progress | How much of the plan has been executed |
| Status | Plan state |
Actions include Choose Audit type to assets, View All Selected Assets, Sync and Delete Audit, with the audit type chosen from VA, PT, Black Box, Grey Box and White Box.
Sync is what turns the plan into real audits. Until it runs the planner is an intention; after it runs the audits exist and appear in their modules.
The supporting tables list Assets, Organisations, BUs, Projects when adding, and
Asset Details, Audit Type, Organisation, Project, Bu, Status when reviewing
what was selected.
Dashboard views¶
Manage Dashboard Views — Name, Created By, Created On. Each view is a saved
profile deciding which sections and widgets the Assets dashboard shows, and which filter
it opens with.
Creating one is three decisions:
| Decision | What it controls |
|---|---|
| Asset types | Which of Web, Mobile, Thick Client, API, Network and Container the dashboard covers. At least one is required |
| Sections | The panels shown — Overall, Network VA, Network PT, Policy Config and the per-asset-type sections. Each section can be expanded to pick its sub-sections individually |
| Filters | Organisation, business unit and project the view opens with, plus anything under More Filters |
A view is Private unless you make it otherwise, so building one is safe: it changes nothing for anyone else until you share it.
Each row carries up to five actions, and which of them appear tells you what kind of view it is:
| Action | Available on |
|---|---|
| Preview Dashboard | Every view, including the system one — the safe way to see what a view shows before adopting it |
| Edit Dashboard | Views you may change: your own private views, or any view if you hold the update permission. Never the system view |
| Make Public | A private view you may change. It publishes the view to everyone |
| Make Default | Any view, with the permission. Greyed out on the view that is already your default |
| Delete Dashboard | Any view but the system one, with the permission |
Publishing is one-way on this screen
There is a Make Public action and no matching action to make a view private again. If one was published prematurely, deleting it and rebuilding is the route back — so preview it and check its filters before publishing rather than after.
The system view is the platform's own default. It cannot be edited, published or deleted, which is deliberate: it is the arrangement everyone falls back to, and it stays recognisable.
Two things are worth knowing before you build one. The dashboard renders a heading for every enabled section, so a view with everything enabled produces a long page where most sections are empty — enabling only what a team looks at is what makes the view useful rather than complete. And the saved filter is part of the view: a view scoped to one business unit will always open scoped to it, which is the point, but it also explains a colleague's "the totals are too low" when they are using someone else's view.
Both dashboards export via Download as PDF / Download as PNG, and the asset dashboard through PDF / PNG.
Change accessibility¶
Asset ID, Asset — bulk-sets whether assets are externally or internally reachable.
Accessibility drives prioritisation in Network PT, where an external Medium usually
outranks an internal High.