Asset ledger
Map the hostnames, IPs and accounts in alerts to business assets and owners. CSV import, plus Elastic's own entity store.
The "Affected assets: web-prod-01, Finance, owner Zhang San, criticality high" line in an investigation report comes from the asset ledger. Investigations run without it with an empty asset column. Every edition.
Coverage
The top of the page samples recent alerts and computes a coverage rate: of the alerts that have a subject (host / user / IP), how many resolve in the ledger. 0% means nothing is imported, or the hostnames in alerts do not match the ledger (web-07 vs web-07.corp.local; short name and FQDN match each other, other spellings do not).
Sources
The ledger is the union of three sources; the page shows which are available:
| Source | Notes |
|---|---|
entity_store | Elastic Security's Entity Store, read automatically when enabled |
criticality | Elastic Security's Asset Criticality |
csv | Imported here, stored in .rst_copilot_assets / .rst_copilot_identities |
CSV import
Two tables with fixed columns; any extra column is rejected ("Download sample" has the header row):
Assets: name, host, ip, criticality, category, owner, department
name,host,ip,criticality,category,owner,department
Finance-DB-01,WIN-DB01.corp.local,203.0.113.5,high,database,Zhang San,Finance
Web-07,web-07.corp.local,,medium,server,Li Si,OperationsIdentities: name, user, criticality, category, owner, department
name,user,criticality,category,owner,department
Zhang San,CORP\jsmith,high,employee,Wang Wu,Finance
svc_backup,svc_backup,high,service,Li Si,Operationsname is required; criticality is high / medium / low; category is free text. Up to 50000 rows per import. Re-importing overwrites by host + ip (assets) / user (identities), so a corrected row for the same host replaces the old one.
The list
Assets and Identities tabs; search by name, owner, department, or directly by hostname / IP / account.
What it affects
- Alert investigation: the first step, asset / identity enrichment, reads it; criticality feeds the severity verdict.
- Live alerts details show asset and owner.
- Batch triage sends the cluster subject with its asset data to the model.