Reconcile security asset inventories

Compare endpoint, cloud, and software inventories to find what each tool misses. Record unmanaged assets and missing owners, then send the gaps to the team that can fix them.

Tools for asset management

MCP servers for the tools used in these examples.

AWS

Wiz

Automation examples and starter prompts

Paste a prompt into Claude Code, Microsoft Copilot, or Codex connected to Tracecat MCP. Adapt it to your tools and test before deployment. Human tool approvals and advanced case features require Enterprise.

Reconcile asset inventories across tools

ID.AM-01

Build me an inventory reconciliation workflow in Tracecat. Pull hosts from CrowdStrike, devices from Jamf, and instances from AWS, then diff the three. Surface machines missing an EDR agent, devices unknown to MDM, and cloud instances nobody enrolled anywhere. Write the unified inventory to a Tracecat table and open a ServiceNow ticket per unmanaged asset. First help me understand how this maps to ID.AM-01 and why the gaps between inventories matter more than any single inventory. Ask me which of these systems I should treat as the source of truth. Talk me through a weekly schedule versus reconciling continuously as assets appear.

Maintain a living software inventory

ID.AM-02

Build me a software inventory automation in Tracecat. Pull installed applications from Jamf and the SaaS estate from Okta sign-in data, keep both in one table with owner and last-seen date, and flag new software that nobody approved. Post a weekly digest of additions and removals to the security channel. First help me understand how this maps to ID.AM-02 and why shadow SaaS is usually the biggest blind spot. Ask me whether we have an approved software list to diff against. Talk me through handling the long tail of one-off tools without drowning the team in tickets.

Prioritize assets by criticality

ID.AM-05

Build me an asset criticality scoring workflow in Tracecat. Enrich our asset table with owner, environment, internet exposure from Wiz, and the data classification of what each asset touches. Score each asset on a simple rubric and write the tier back to the table so triage and vulnerability workflows can read it. First help me understand how this maps to ID.AM-05 and how criticality tiers change downstream response decisions. Ask me what makes an asset critical in our business. Talk me through keeping scores current as assets change roles.

Track data stores and their metadata

ID.AM-07

Build me a data inventory automation in Tracecat. Enumerate S3 buckets and RDS databases from AWS and shares in Snowflake, record each store with its owner, classification, and retention expectation, and flag stores with no classification or no owner. Re-run monthly and track newly appeared stores. First help me understand how this maps to ID.AM-07 and why data inventories decay faster than hardware ones. Ask me which data types we have designated as sensitive. Talk me through whether unclassified stores should open tickets or feed a review queue.

NIST CSF 2.0 mapping: ID.AM

Official NIST category: Asset Management. Assets (e.g., data, hardware, software, systems, facilities, services, people) that enable the organization to achieve business purposes are identified and managed consistent with their relative importance to organizational objectives and the organization's risk strategy

The controls and implementation examples below are NIST source material. The automation prompts above are Tracecat-authored starting points, not evidence of compliance or full control coverage.

ID.AM-01
CM-8
PM-5
Inventories of hardware managed by the organization are maintained
- Maintain inventories for all types of hardware, including IT, IoT, OT, and mobile devices
- Constantly monitor networks to detect new hardware and automatically update inventories
ID.AM-02
AC-20
CM-8
PM-5
SA-5
SA-9
Inventories of software, services, and systems managed by the organization are maintained
- Maintain inventories for all types of software and services, including commercial-off-the-shelf, open-source, custom applications, API services, and cloud-based applications and services
- Constantly monitor all platforms, including containers and virtual machines, for software and service inventory changes
- Maintain an inventory of the organization's systems
ID.AM-03
AC-4
CA-3
CA-9
PL-2
PL-8
PM-7
Representations of the organization's authorized network communication and internal and external network data flows are maintained
- Maintain baselines of communication and data flows within the organization's wired and wireless networks
- Maintain baselines of communication and data flows between the organization and third parties
- Maintain baselines of communication and data flows for the organization's infrastructure-as-a-service (IaaS) usage
- Maintain documentation of expected network ports, protocols, and services that are typically used among authorized systems
ID.AM-04
AC-20
SA-9
SR-2
Inventories of services provided by suppliers are maintained
- Inventory all external services used by the organization, including third-party infrastructure-as-a-service (IaaS), platform-as-a-service (PaaS), and software-as-a-service (SaaS) offerings; APIs; and other externally hosted application services
- Update the inventory when a new external service is going to be utilized to ensure adequate cybersecurity risk management monitoring of the organization's use of that service
ID.AM-05
RA-2
RA-3
RA-9
Assets are prioritized based on classification, criticality, resources, and impact on the mission
- Define criteria for prioritizing each class of assets
- Apply the prioritization criteria to assets
- Track the asset priorities and update them periodically or when significant changes to the organization occur
ID.AM-07
CM-12
CM-13
SI-12
Inventories of data and corresponding metadata for designated data types are maintained
- Maintain a list of the designated data types of interest (e.g., personally identifiable information, protected health information, financial account numbers, organization intellectual property, operational technology data)
- Continuously discover and analyze ad hoc data to identify new instances of designated data types
- Assign data classifications to designated data types through tags or labels
- Track the provenance, data owner, and geolocation of each instance of designated data types
ID.AM-08
CM-9
CM-13
MA-2
MA-6
PL-2
PM-22
PM-23
SA-3
SA-4
SA-8
SA-22
SI-12
SI-18
SR-5
SR-12
Systems, hardware, software, services, and data are managed throughout their life cycles
- Integrate cybersecurity considerations throughout the life cycles of systems, hardware, software, and services
- Integrate cybersecurity considerations into product life cycles
- Identify unofficial uses of technology to meet mission objectives (i.e., shadow IT)
- Periodically identify redundant systems, hardware, software, and services that unnecessarily increase the organization's attack surface
- Properly configure and secure systems, hardware, software, and services prior to their deployment in production
- Update inventories when systems, hardware, software, and services are moved or transferred within the organization
- Securely destroy stored data based on the organization's data retention policy using the prescribed destruction method, and keep and manage a record of the destructions
- Securely sanitize data storage when hardware is being retired, decommissioned, reassigned, or sent for repairs or replacement
- Offer methods for destroying paper, storage media, and other physical forms of data storage

Control text and SP 800-53 Rev 5 references from the official NIST CSF 2.0 and OLIR releases.

Build your own security automation

Adapt a starter prompt with your coding assistant, choose where AI agents or fixed workflows fit, and test with your tools.

All examples Book a demo