Asset Inventory

Unified Asset Inventory

The same physical machine shows up across GuardFox as several unrelated records: an EDR agent, a Vulnerability asset, an Nmap target, and a SIEM host — and they don't always agree (e.g. srv-web-02 is one IP in EDR but another in Vuln Mgmt). Answering "what do we know about srv-web-02?" used to mean visiting four screens and reconciling them by hand.

The Asset Inventory joins those existing records into one asset per machine. It's a correlation layer — it owns no new data and writes nothing; it merges what the other modules already collected.

How assets are correlated (conservative by design)

• Primary key is the short hostname (lowercased, domain stripped), so srv-web-02 and srv-web-02.internal resolve to the same asset.
• EDR and Vuln Mgmt provide an authoritative IP → hostname index.
• An IP-only signal attaches to a hostname asset only when that exact IP is in the index — otherwise it stays its own IP-keyed asset. GuardFox under-merges rather than wrongly fusing two machines.

What each row shows

Which subsystems have seen the asset (EDR / Vuln / Nmap / SIEM / Incident), its IPs, a correlated risk score, and data-quality notes — most importantly a hostname that resolves to more than one IP across sources.

Hunt an Indicator

The Hunt an Indicator panel answers a question the way an analyst actually thinks — not "here are 40 events" but "this C2 IP touched srv-dc01 and ws-eng-17."

1. Go to Asset Inventory and enter an IP, domain, or file hash in the hunt box.
2. GuardFox searches SIEM, EDR, and DNS at once (all strictly org-scoped) in a single pass.
3. Results are grouped by resolved asset, most hits first, with a per-source breakdown (SIEM x / EDR y / DNS z) and a sample line.

Resolution reuses the same IP → hostname index as the inventory, so a hit lands on the same asset the inventory shows. Hits that carry neither a host nor a known IP are counted as unresolved rather than dropped.

• IP hunts also match the free-text SIEM message (many sources record an IP only in text like "Outbound connection to 185.220.101.45:443"), not just structured srcIp/dstIp.
• Domain hunts additionally run the DGA scorer (below), so an algorithmic domain is flagged even with zero telemetry hits.

DGA Detection

Malware families use a Domain Generation Algorithm (DGA) to invent large numbers of random-looking domains (kq3v9z7bx1p.net) to evade domain blocklists. GuardFox scores a domain's name structure — independent of any telemetry — using:

• Shannon entropy of the registrable label
• rare-bigram ratio (how many letter-pairs are uncommon in real domains)
• longest consonant run

Scores map to a verdict: likely_dga (score ≥ 62) or suspicious (≥ 38). Thresholds are calibrated so ordinary brandable names (flickr, tumblr, bit.ly) stay benign.

Where it appears

• The DNS analyzer flags a domain as malicious when it's a watchlist hit or scores likely_dga.
• A domain hunt in the Asset Inventory shows the DGA verdict even when no asset has queried the domain yet.

Crown Jewels — Business Criticality

A KEV on a lab VM and a KEV on the primary domain controller score the same technically — but they are not the same problem. Criticality lets you tell GuardFox which assets matter to the business, and folds that into a business-weighted triage priority without touching the technical score.

Setting an asset's criticality

1. Expand an asset in the inventory.
2. In Business Criticality, pick a tier: Critical, High, Normal (default), or Low. Add an optional label (e.g. "Primary domain controller").

How priority is weighted

The Priority column re-weights the technical correlatedRisk:

• Critical — floored at 55 and boosted (+20). A crown jewel never looks quiet.
• High — +10.
• Low — −20.
• Normal — unchanged.

The technical risk is preserved and shown in the row as base N, so the number stays honest while the queue orders by what matters to the business. A Crown Jewels filter and summary count surface your critical assets at a glance.