Product guidance ยท September 23, 2026
An asset name can connect a security observation to a business decision, but only if the team understands where that identity and business context came from. Ownership changes, inventory ages and different systems can disagree. A useful review retains those uncertainties.
Separate asset context from security evidence
Threat Foundry normalizes selected asset information from ServiceNow CMDB, Jira Service Management Assets Cloud, Lansweeper, BMC Helix CMDB and Device42. Supported fields can describe identity, ownership and criticality, together with their source provenance and freshness.
That context helps an analyst explain why an asset matters. It does not establish malicious activity or prove that a hunt evaluated the asset. A successful query and a matching asset name are different facts.
Review conflicts before relying on a fact
Consider a service with one owner in a CMDB and another in a discovery system. Selecting whichever value arrived most recently can hide a meaningful disagreement. Review the source assertions, identity confidence and freshness, then decide which explicit asset revision belongs beside the work.
The supported adapters perform read-only, resumable full synchronization. Their public HTTPS endpoints, credentials, mappings and instance permissions need configuration for the environment. Missing records do not prove that an asset was deleted or retired.
Preserve the context behind the decision
A historical hunt should remain understandable after the inventory changes. Selected immutable revisions retain the context reviewed at that time. A later synchronization supplies new context for a new decision; it does not silently rewrite the earlier evidence.
Hunt context also distinguishes intended scope, explicitly supported executed scope and assets observed in returned evidence. The new selection is advisory: it does not prove that normalized asset metadata generated or narrowed the query.
Apply the same discipline to architecture
Blueprint components can retain exact asset revisions. Material context changes require renewed review before an affected proposal is applied. A CMDB refresh does not automatically redraw topology or turn an asset relationship into an attack path.
Start with one important business service, review its source disagreements and select a small, relevant set of assets. The objective is an explainable decision, with the evidence and its limits still attached.