Asset Management, Repositories, and Asset Lists
Repositories
Repositories store raw scan results and are the unit of analysis in SC. Results are scoped to a repository, so a report or analysis naming the wrong repository returns nothing useful. Repositories carry data expiration (purge) and trending retention settings; deleting a repository deletes its data permanently. Offline repositories accept imported .nessus files for air-gapped sites or third-party scans.
Assets and asset lists
Assets are created from scan and import results - you do not type them in by hand. Asset lists are named collections used to scope scans, reports, and dashboards. Static lists hold explicit IPs, ranges, or imported entries; dynamic lists are defined by filters (IP range, DNS name, OS, severity, plugin, LDAP/AD group) and refresh automatically on their interval. Both are organization-scoped, and a user restricted to an asset list sees only matching assets.
Traps
- Deleting an asset list does not delete the underlying assets, and an empty or stale dynamic list silently produces empty reports.
- Asset lists do not constrain what a scan targets unless you select them at launch; scan zones, not asset lists, govern scanner routing.
- Combining an asset list with an additional IP filter intersects the two; it does not union them.
- Assets seen in one organization are not visible in another.
Rule of thumb: one repository per purpose (weekly production, DMZ, offline imports) and dynamic asset lists for anything that changes - for example, Windows servers with critical or high findings in the last 30 days, refreshed daily, instead of a hand-maintained IP file.