Find Affected Assets

Description

Lists Affected Assets. An Affected Asset is the join between an Asset and a Vulnerability - it records that a specific asset is impacted by a specific vulnerability, along with per-instance details (components, notes, tags, remediation state). Use this to enumerate which assets a vulnerability touches, or which vulnerabilities touch an asset.

Filter to specific records by passing their ids in ids; omit ids to list every Affected Asset the caller has access to. The fields asset_type, external_asset_id, and details are only populated when the Assets module is enabled. Results are paginated (default 10 per page, max 50).

How To Enable

1. Go to Users

2. Select the user you would like to provide access to this tool

3. Click on Access > MCP

4. Click on Add Tools

5. Select the tool find_affected_assets and click Add

Example Prompts

• How many affected assets do I have? Include custom fields in the response.

• Show me the affected assets for vulnerability ID 64e17a99009140000f4acf6e.

• What are the details and components for the affected assets on my critical vulnerabilities?

• List all affected assets including their tags and notes.

• Show me affected assets with their external asset IDs and asset types.

• Which assets are internet-facing based on their custom fields?

Parameters

Parameter	Type	Required	Description
ids	array	No	Optional list of Affected Asset ids to fetch. Each id is the 24-hex ObjectId of the Affected Asset itself (NOT an Asset id and NOT a Vulnerability id). Source them from a prior find_affected_assets call, or from affected_assets[*].id on a vulnerability returned by find_vulnerabilities. Omit to list all Affected Assets the caller can access.
fields	array	No	System fields to include (id is always returned). Supported values are listed below.
custom_field_keys	array	No	Custom field keys to include. Affected Assets carry the custom fields of their underlying Asset model - discover keys via get_field_structure(model="asset").
limit	integer	No	Maximum records to return in this page. Default 10, max 50.
skip	integer	No	Number of records to skip (offset). Default 0.

Supported fields values:

Field	Type
id	string
name	string
components	array of { name: string, notes: array of string, tags: array of string }
notes	array of string
tags	array of string
actioned	boolean
asset_type	string
external_asset_id	string
details	string
vulnerability_id	string

Example Response

{
  "data": [
    {
      "id": "64e17a99009140000f4acf70",
      "name": "192.168.0.1",
      "components": [
        {
          "name": "192.168.0.1",
          "notes": [
            "http://www.nessus.org/u?3a040ada"
          ],
          "tags": [
            "port:21",
            "protocol:tcp",
            "severity:1",
            "cve:CVE-2007-1858"
          ]
        }
      ],
      "notes": [],
      "tags": [],
      "actioned": false,
      "asset_type": "Infrastructure",
      "external_asset_id": "CMDB-123",
      "details": "This asset is the main router for the head office",
      "custom_fields": [
        {
          "key": "internet_facing",
          "value": "Yes",
          "label": "Internet Facing"
        },
        {
          "key": "subnets",
          "value": [
            "192.168.0.0/24",
            "192.168.0.1/24"
          ],
          "label": "Subnets"
        }
      ],
      "vulnerability_id": "64e17a99009140000f4acf6e"
    }
  ],
  "count": 1,
  "total": 1
}