Asset Groups

Asset Groups let you save a named subset of your discovered assets and use it as the scope for reports, documents, and exports — instead of always running against your entire environment.

Typical groups:

• PCI Cardholder Environment — everything in scope for a PCI DSS assessment
• Production — Internet-Facing — your externally reachable prod assets
• Crown Jewels — the data stores that matter most
• AWS us-east-1 — a single provider + region slice

Membership modes

An asset group's membership can be defined three ways:

Mode	How membership is decided
Static	An explicit, pinned list of assets you selected. Membership only changes when you edit the group.
Dynamic	A saved filter (provider, resource type, region, account, VPC, environment, tags, name pattern). Re-evaluated every time you generate an artifact, so newly-discovered matching assets join automatically.
Hybrid	The union of a pinned static list and a dynamic filter, minus any explicit exclusions.

Dynamic filter fields

All populated clauses are combined with AND:

• Providers — aws, azure, gcp, …
• Resource Types — e.g. aws.ec2.instance, aws.rds.instance
• Accounts / Regions / VPC IDs
• Environments — matched against common Environment/env tags
• Tags — key=value (exact) or key (any value)
• Name Regex — e.g. ^web-

Using a group as a report scope

When generating a report, choose an asset group as the scope. The report's graph, findings, and diagrams are then limited to that group's resolved membership (an induced subgraph — edges are included only when both endpoints are in the group; findings are included when they fired against a member asset).

Notes

• Workspace-scoped. A group belongs to the workspace it was created in; there is no cross-workspace membership.
• Dynamic membership is evaluated at generation time, so a report records how many assets matched at that moment. Re-running after new discovery can change the set — the resolved count and timestamp are shown for reproducibility.
• Asset Groups scope results, they do not change what gets scanned. Discovery remains driven by your connectors.