<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: automating-asset-inventory-management
description: >-
  Automate continuous asset discovery, classification, and inventory
  reconciliation across on-prem and cloud environments using API-driven
  collectors, CMDB synchronization, and drift detection with alerting.
domain: cybersecurity
subdomain: security-operations-automation
tags:
  - asset-inventory
  - cmdb
  - discovery
  - automation
  - cloud-assets
  - drift-detection
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1082"]
---

# Automating Asset Inventory Management

## Overview

Continuous asset inventory is foundational to every security control — you
cannot protect what you do not know exists. This technique automates asset
discovery from multiple sources (cloud APIs, network scans, EDR agents,
CMDB exports), reconciles them into a unified inventory, detects drift
between expected and observed state, and alerts on unauthorized assets.

Mode: `[MODE: BLUE]` — Defensive asset visibility and hygiene.

## Prerequisites

| Requirement | Details |
|---|---|
| Python 3.10+ with `requests`, `ipaddress`, `pyyaml` | Required |
| Cloud provider API credentials (AWS, GCP, Azure) | Required |
| CMDB API access (ServiceNow, Snipe-IT) | Required |
| Network scanner access (Nmap, Rumble/runZero) | Required |

## Key Concepts

### Multi-Source Asset Collection

```python
from dataclasses import dataclass, field
from datetime import datetime, timezone
from typing import Any


@dataclass
class Asset:
    """Normalized asset record from any source."""

    asset_id: str
    hostname: str
    ip_addresses: list[str] = field(default_factory=list)
    mac_addresses: list[str] = field(default_factory=list)
    os: str = ""
    asset_type: str = "unknown"
    owner: str = ""
    criticality: str = "standard"
    source: str = ""
    last_seen: str = field(
        default_factory=lambda: datetime.now(timezone.utc).isoformat()
    )
    tags: dict[str, str] = field(default_factory=dict)


def collect_aws_assets(session: Any) -> list[Asset]:
    """Collect EC2 instances from AWS."""
    ec2 = session.client("ec2")
    assets: list[Asset] = []
    paginator = ec2.get_paginator("describe_instances")
    for page in paginator.paginate():
        for reservation in page["Reservations"]:
            for inst in reservation["Instances"]:
                name = ""
                for tag in inst.get("Tags", []):
                    if tag["Key"] == "Name":
                        name = tag["Value"]
                assets.append(Asset(
                    asset_id=inst["InstanceId"],
                    hostname=name or inst["InstanceId"],
                    ip_addresses=[
                        inst.get("PrivateIpAddress", ""),
                        inst.get("PublicIpAddress", ""),
                    ],
                    os=inst.get("Platform", "linux"),
                    asset_type="ec2",
                    source="aws",
                ))
    return assets
```

### Inventory Reconciliation

```python
def reconcile_inventories(
    cmdb_assets: list[Asset],
    discovered_assets: list[Asset],
) -> dict[str, list[Asset]]:
    """Compare CMDB against discovered assets to find drift."""
    cmdb_map = {a.asset_id: a for a in cmdb_assets}
    discovered_map = {a.asset_id: a for a in discovered_assets}

    return {
        "missing_from_cmdb": [
            a for aid, a in discovered_map.items() if aid not in cmdb_map
        ],
        "stale_in_cmdb": [
            a for aid, a in cmdb_map.items() if aid not in discovered_map
        ],
        "matched": [
            a for aid, a in discovered_map.items() if aid in cmdb_map
        ],
    }
```

### Drift Detection and Alerting

```python
import logging

logger = logging.getLogger("asset.drift")


def detect_drift(
    expected: Asset,
    observed: Asset,
    monitored_fields: list[str] | None = None,
) -> list[dict[str, str]]:
    """Detect configuration drift between expected and observed state."""
    fields = monitored_fields or ["os", "ip_addresses", "owner", "criticality"]
    drifts: list[dict[str, str]] = []
    for f in fields:
        expected_val = getattr(expected, f, None)
        observed_val = getattr(observed, f, None)
        if expected_val != observed_val:
            drifts.append({
                "field": f,
                "expected": str(expected_val),
                "observed": str(observed_val),
                "asset_id": expected.asset_id,
            })
    if drifts:
        logger.warning("Drift detected on %s: %d fields changed", expected.asset_id, len(drifts))
    return drifts
```

## Workflow

### Step 1: Discover Assets

```bash
node scripts/agent.js --action discover --source aws
```

### Step 2: Reconcile with CMDB

```bash
node scripts/agent.js --action reconcile
```

### Step 3: Check for Drift

```bash
node scripts/agent.js --action drift-report
```

## Detection

```yaml
title: Automating Asset Inventory Management Detection
id: 9f1c3741-9c57-43ea-a936-61c82a5039fc
status: experimental
description: Detects suspicious activity related to automating asset inventory management techniques in security operations automation context
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine: "*automating*asset*"
  condition: selection
level: medium
tags:
  - attack.t1082
  - attack.discovery
falsepositives:
  - Orchestration platform executing approved automation workflows
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Automating Asset Inventory Management Detection | linux/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1082 |

## Verification

- [ ] Assets collected from all configured sources
- [ ] Reconciliation identifies missing and stale assets
- [ ] Drift detection flags changed fields with before/after values
- [ ] Unauthorized assets trigger alerts

## References

- [CIS Control 1 — Inventory and Control of Enterprise Assets](https://www.cisecurity.org/controls/inventory-and-control-of-enterprise-assets)
- [NIST SP 800-53 CM-8 — System Component Inventory](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final)
- [runZero Asset Inventory](https://www.runzero.com/)
