Skip to content

Asset management

Assets are hosts, users, and services that LogMan.io learns from your event stream. The platform tracks when each entity was first and last seen, whether it is still active, and how detection activity affects its risk score. Use Assets to maintain an inventory, spot inactive or risky entities, and jump into Discover for deeper investigation.

This page describes the analyst workflow in the web app. It does not cover server configuration.

Who can do this?

Opening the Assets module requires lmio:asset:access. Editing tags, alerts, or deleting assets requires lmio:asset:edit. Changing alternate names or risk score weight requires lmio:lookup:edit. Opening Discover from an asset requires bitswan:discover:access.

Open the Assets module

In the main menu, select Assets (box icon). You can browse:

Screen What it shows
All assets Full inventory
Hosts Computers and servers
Users User accounts
Services Service principals
Asset detail One entity with charts and settings

Assets are created automatically when matching events arrive. You do not create them manually in the UI.

What you see on the list

The asset table includes:

Column Meaning
Id Principal name (hostname, username, service id). Click to open detail.
Alert badge Whether a stale after alert is configured (see below)
Last activity Most recent event for this asset
Risk score Current entity risk from detections (time decayed)
Activity Green dot = active; grey = inactive

Use the search box to filter by id or type. Use Activity filter for Active or Inactive only. Sort by id, last activity, risk score, or activity status.

Download all exports the current filtered list to CSV.

Asset detail: charts and sidebar

Click an asset Id to open its detail page.

  • Type — host, user, or service
  • First / last activity — when LogMan.io first and last saw this entity
  • Average risk score — decayed score from detection events
  • Activity status — active or inactive
  • Alternate names — aliases (hostname, IP, username, email) for hosts and users
  • Stale after (alert) — inactivity threshold before an alert is raised
  • Risk score weight — multiplier that influences detection scoring for this principal
  • Tags — labels you assign for filtering and reporting

Charts

  • Activity — event volume over time (by dataset when available)
  • Risk score — peak detection risk per time bucket
  • Related principals — hosts show related users; users show related hosts

Use the date range picker and optional LARK filter, then Fetch data to refresh charts. Default range is the last three days.

Open in Discover

Click Open in Discover to search raw events for this principal in the selected time range. This is the main path from an asset to a full investigation.

Risk score vs activity

These measure different things:

Concept Source Question it answers
Activity Activity event lane Is this entity still sending logs?
Risk score Detection events (complex lane) How much suspicious activity involved this entity recently?

A host can be active (still logging) with a low risk score, or inactive with a high score left over from past detections until the score decays.

The line chart on the detail page shows when detections spiked. An empty bucket means no qualifying detection events in that interval.

Stale asset alerts

You can ask LogMan.io to alert when an asset stops sending events.

  1. On asset detail (or via Bulk actions on the list), set Stale after (alert) — for example 4h or 1d
  2. Save

If no activity occurs within that window, Alert Management receives an Asset inactive signal. When activity resumes, the alert closes automatically.

To stop monitoring, clear the threshold (X button on detail, or Clear alerts in bulk actions).

Default for new assets

New assets may get a default stale alert from server configuration (often a few hours). Your administrator controls the default. You can change or clear it per asset.

Notifications when a new asset appears

Administrators can enable asab-iris notifications (email, Slack, SMS, or push) when LogMan.io discovers a new host, user, or service from the activity stream.

Mode What you receive
Instant One message when the asset is first created
Scheduled A periodic summary of assets created in the last interval (default often 1 hour)

These are not the same as stale asset alerts (those go to Alert Management when an asset goes quiet). New-asset notifications only fire on first discovery, not on every later last_seen update.

Setup is Library + service config (channel, templates, optional filters). Ask your administrator, or see Assets configuration.

Filtering noise from the inventory

Some identities should never become assets (for example Windows SYSTEM, or throwaway hostnames). Administrators can filter them in two places:

Layer Where What it filters
Assets Library /Assets/Skip/settings.yaml Host and user titles via names / prefixes / suffixes / contains (case-insensitive); drops those assets on activity and complex
Parsec event lane parsec.asset.skip Host and user via exact / prefixes / suffixes / contains; drops them from the activity Kafka stream

Use Library /Assets/Skip/ (prefixes, min_hyphens, …) in the inventory. Details: Assets configuration and Parsec asset management.

Tags and alternate names

Tags

Tags are free form labels (for example critical, prod, owner:team_a). They appear in asset lists and can be included in alert attributes. Add or remove tags on the detail page if you have edit permission.

Alternate names

Hosts and users can have alternate names: extra hostnames, IP addresses, MAC addresses, usernames, or emails that should map to the same asset. This helps when the same machine or person appears under different identifiers in logs.

Editing alternate names requires lookup edit permission because values are stored in watcher lookups.

To keep directory scale username → user.id mappings current from Active Directory, use an LDAP feed into usernames2userid. See LDAP / AD user identity feed.

Risk score weight

Risk score weight (0 to 100) adjusts how strongly detections affect this asset's score. Use it for known good systems (lower weight) or high value targets (higher weight). Requires lookup edit permission.

Bulk actions on the list

  1. Open All assets (or Hosts, Users, Services)
  2. Click Bulk actions (grid icon)
  3. Select rows with checkboxes, or select all on the page
  4. In the side panel:
  5. Set or clear Stale after (alert) for the selection
  6. Delete selected assets (confirmation required)

Deletion removes the asset record. It will be recreated if matching events arrive again.

Typical analyst workflows

Find risky or quiet assets

  1. Open Assets → All
  2. Sort by Risk score descending, or filter Inactive
  3. Open interesting rows to review charts and last activity

Investigate one host or user

  1. Open asset detail
  2. Set the date range to cover the incident
  3. Check the risk score chart for detection spikes
  4. Check the activity chart for logging gaps
  5. Click Open in Discover to read individual events
  6. For hosts or users, review related principals for lateral context

Monitor critical servers

  1. Open the host asset
  2. Set Stale after (alert) to a sensible window (for example 2h)
  3. Add tags such as critical
  4. Respond to Asset inactive alerts in Alert Management

Clean up aliases after a rename

  1. Open the host or user asset
  2. Add the new hostname or username under Alternate names
  3. Keep the old name until events no longer use it

How assets relate to detections

flowchart TB
    EV[Incoming events]
    ACT[Activity lane]
    CMP[Complex lane / detections]
    AST[(Assets)]
    UI[Assets screens]
    DIS[Discover]
    ALM[Alert Management]

    EV --> ACT
    EV --> CMP
    ACT --> AST
    CMP --> AST
    AST --> UI
    UI --> DIS
    AST --> ALM
  • Activity updates first seen, last seen, and active or inactive status
  • Detections on the complex lane feed the risk score
  • Stale alerts link assets to Alert Management, not to the Detections screen
  • New-asset notifications (optional) go through asab-iris, not Alert Management

There is no direct link from every alert back to the asset page. Search the asset list or use Discover when you know the principal id.

Permissions summary

Task Permission
View Assets lmio:asset:access
Edit tags, stale alert, delete lmio:asset:edit
Edit alternate names, risk weight lmio:lookup:edit
Open in Discover bitswan:discover:access
View underlying lookups lmio:lookup:access
Handle stale asset alerts lmio:alert:access (Alert Management)