Blackpoint Asset Inventory

Assets are the leaves of the CompassOne hierarchy — every detection and vulnerability fires against one. This skill covers enumerating them, searching across classes, and mapping how they connect.

Anti-triggers

• Another vendor's asset inventory — "asset" is one of the most overloaded words in the stack. Network discovery is runzero-assets, EDR-managed endpoints are sentinelone-inventory or huntress-agents, and RMM device records are the RMM plugin's. A CompassOne asset only exists because CompassOne monitors it.
• What is wrong with an asset — findings against it are blackpoint-vulnerability-management (exposure) or blackpoint-incident-response (detections).
• Counting assets across every customer — use blackpoint-multi-tenant-operations; blackpoint_assets_list is scoped to one tenant and one class per call.

Asset Classes

blackpoint_assets_list requires an asset class. The supported classes are:

• endpoint — workstations, laptops
• server — physical and virtual servers
• network — switches, routers, firewalls
• cloud — cloud accounts and resources
• mobile — phones, tablets
• iot — IoT and OT devices

API Tools

Tool	Purpose
blackpoint_assets_list	List assets of a given class for a tenant (paginated)
blackpoint_assets_get	Full detail for one asset
blackpoint_assets_search	Search assets across all classes by name / identifier
blackpoint_assets_relationships	Walk parent / child / sibling links from a source asset

Common Workflows

Full inventory for a tenant

1. Confirm the tenant with blackpoint_tenants_get.
2. Call blackpoint_assets_list once per class (endpoint, server, network, cloud, mobile, iot).
3. Paginate each class fully — endpoint counts can run high.
4. Roll up: total assets, count per class, count per status.

Find a specific asset fast

1. Use blackpoint_assets_search with a hostname, serial, or identifier — it spans all classes, so you do not need to know the class first.
2. Narrow with the classes and tenant_ids filters if the search returns matches across multiple tenants.
3. Pull blackpoint_assets_get on the match for full detail.

Build a relationship / topology map

1. Identify the entry asset with blackpoint_assets_search.
2. Call blackpoint_assets_relationships with the source asset ID. Use the direction filter (parent / child / sibling) and the related_class filter to control the walk.
3. For each related asset, optionally pull detail and any open detections to build a blast-radius view.

Edge Cases

• Class is required — blackpoint_assets_list will not return "all assets" in one call; you must iterate the six classes. Use blackpoint_assets_search when you genuinely want a cross-class view.
• Asset identity drift — a re-imaged endpoint can produce two asset records. Dedupe on hostname / serial before reporting counts.
• Read-only — there are no tools to create, retire, or modify assets; lifecycle changes happen in the CompassOne portal.

Best Practices

• Always carry the tenant name in inventory output — partner-level work spans many customers.
• Pair blackpoint_assets_relationships with detection lookups when the question is about blast radius, not just topology.

Related Skills

• incident-response - Pivoting from a detection to its asset
• api-patterns - Hierarchy, auth, pagination