Asset Identity Center

The Asset Identity Center page unifies information from detected addresses, devices, and users into a single page, while building a data structure to store the user and device information in the backend. Asset view groups information by Device, while Identity view groups information by User. Hover over a device or a user in the GUI to perform different actions relevant to the object, such as adding a firewall device address, adding an IP address, banning the IP address, quarantining the host, and more.

To view the Asset Identity Center page:

1. Go to Security Fabric > Asset Identity Center.

2. Click Asset to view information by device. The available columns are Device, Software OS, Hardware, FortiClient User, User, Status, Vulnerabilities, Endpoint Tags, and Last Seen. The optional columns are Address, Firewall Address, Hostname, IP Address, and Server.

   

3. Click Identity to view information by user. The available columns are User, Device, and Properties. The optional columns are IP Address, Logoff Time, and Logon Time.

   

   Each view has a dropdown option to view the information within different time frames (Latest, 1 hour, 24 hours, and 7 days). Vulnerability information is displayed when applicable. The page displays user and device relationships, such as which users are logged in to multiple devices or if multiple users are logged in to single devices.

   

   

4. Hover over a device in the list to view the tooltip and possible actions. In this example, the available actions are add firewall device address, add firewall IP address, and ban the IP.

   

Diagnostics for the unified user device store

The following options are available for diagnose user-device-store unified <option>:

Option	Description
device-memory-query	Get device records and associated user records from memory.
device-query	Get device records and associated user records from memory and disk.
user-memory-query	Get user records and associated device records from memory.
user-query	Get user records and associated device records from memory and disk.
re-query	Retrieve query by <query-id> <iteration-start> <iteration-count> (takes 0-3 arguments).
list	List unified queries.
clear	Delete all unified queries.
dump	Dump unified query stats by <query-id> (takes 0-1 arguments).
delete	Delete unified query by <query-id> (takes 0-1 arguments).
stats	Get statistics for unified queries.
debug	Enable/disable debug logs for unified queries.