---
title: "Asset Categorization: Classification Logic and Taxonomy"
slug: "asset-categorization"
updated: 2026-10-22T15:02:28Z
published: 2026-10-22T15:02:28Z
canonical: "docs.safe.security/asset-categorization"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.safe.security/llms.txt
> Use this file to discover all available pages before exploring further.

# Asset Categorization: Classification Logic and Taxonomy

## Introduction

The Asset Categorization system is designed to automatically classify every asset in the network. Rather than relying on a single rule, the system uses a weighted hierarchy of multiple observations, ranging from machine learning models to API integrations, to assign a specific Type and Subtype to every asset.

This document outlines the operation of the classification engine and defines the standard taxonomy used for reporting and policy creation.

## Categorization Engine: A Hierarchy of Experts

The classification logic is not a single algorithm but an Ensemble Hierarchy of Experts. Think of this as a committee where different "experts" analyze specific attributes of an asset to determine its identity.

The logic follows a "Last Man Standing" principle: decisions made in earlier steps (like the Base Prediction) can be overwritten by later steps (like Cloud Integrations or Manual Overrides).

## How Assets Get Classified

The system evaluates multiple signals to determine the nature of an asset. These signals are processed in order of reliability—when a more authoritative source provides classification data, it takes precedence over less certain methods.

**Classification Priority (highest to lowest):**

1. **Manual Classification:** When a user or administrator explicitly sets an asset's type, that decision is final. This is the highest authority because humans understand context that automated systems cannot infer.
2. **Cloud Provider Data:** If the asset exists in AWS, Azure, or GCP, the cloud provider's API provides definitive identification. AWS knows with certainty that a resource is a Lambda function or an RDS database—this is more reliable than inferring from network behavior.
3. **Pattern-matching Rules**: Predefined pattern-matching logic for well-known asset signatures. For example, "Cisco IOS in the OS field indicates a networking asset" or "a Meraki MR model number indicates a wireless access point."
4. **Operating System**: The most reliable automated signal. When we detect a specific OS like "Windows Server 2019" or "Cisco IOS", we can confidently classify the asset. Generic operating systems (like "Linux" alone) are less conclusive and defer to other signals.
5. **Asset Tags**: Labels from third-party integrations (Armis, Claroty, Medigate) or internal tagging systems. Particularly valuable for specialized equipment, such as medical assets, where OS detection is often unavailable or proprietary.
6. **Manufacturer**: The asset manufacturer, derived from the network adapter's MAC address. Certain manufacturers produce specific asset types; for example, Axis Communications primarily manufactures security cameras, while Zebra Technologies specializes in barcode scanners.
7. **Hostname Patterns**: Semantic clues in the asset’s name. Organizations often follow naming conventions: "MBP" typically indicates a MacBook Pro, "VDI" suggests virtual desktop infrastructure.
8. **Software Inventory**: The installed software stack provides hints about the asset’s purpose. A machine running Redis Server is likely a database; one running Cisco Unity is likely a VoIP system.
9. **Combined Feature Analysis**: When no single signal is definitive, the system evaluates all available data together to make the most accurate classification possible. If confidence remains low, the asset is marked as needing review.

After determining the primary type, the system refines the subtype using additional context. For example, a "Server" is further classified as a Virtual Machine (VMware), Cloud Virtual Machine (Amazon/Azure/GCP), or Physical Server based on manufacturer and deployment indicators.

## Asset Visibility: Understanding Data Quality

**What Qualifies as "Poor Visibility"?**

Poor visibility occurs when an asset lacks sufficient distinguishing characteristics for reliable categorization. Assets with poor visibility are marked as 'Unexamined' until they are enriched with better data.

The following conditions indicate poor visibility:

- Insufficient Identifying Information
- No operating system detected, or only a generic OS (like "Linux") without additional context
- No hostname, or hostname contains only an IP address
- No MAC address available to determine manufacturer
- No tags from third-party integrations or manual labeling

**Conflicting Signals**

When different data sources suggest contradictory classifications with no clear winner. For example, OS information suggests "Server" while hostname patterns suggest "Desktop", and no manufacturer data is available to break the tie.

**Sparse Data**

Assets where only minimal data is available, such as a generic Linux OS with no hostname, no tags, and no manufacturer information. These assets cannot be confidently classified and require enrichment.

## Data Requirements for Categorization

### **What Data Enables Classification?**

To successfully categorize an asset, the system needs at least one of the following:

| **Data Type** | **What It Provides** | **Examples** |
| --- | --- | --- |
| **Operating System** | Identifies the asset platform and purpose | Windows Server 2019, iOS 17, Cisco IOS, macOS Ventura |
| **Cloud Provider Data** | Definitive resource identification from AWS/Azure/GCP APIs | EC2 instances, Lambda functions, RDS databases, S3 buckets |
| **Asset Tags** | Asset type labels from integrations or manual input | Medical asset tags from Medigate, IoT tags from Armis |
| **Manufacturer** | Asset maker from the MAC address | Apple, Dell, Axis Communications, Zebra Technologies |
| **Hostname** | Naming convention clues | Patterns like "MBP" (MacBook Pro), "VDI" (virtual desktop) |
| **Software Inventory** | Installed applications and services | Redis Server, Cisco Unity, medical imaging software |
| **Open Ports** | Network service signatures | Web servers, databases, and specialized protocols |

### **Where Does This Data Come From?**

| **Data Type** | **Collection Methods** |
| --- | --- |
| Operating System | Endpoint agents, network scans, vulnerability scanners |
| Cloud Resources | Eg, AWS, Azure, GCP, Wiz, and other cloud-connector integrations where the cloud resource-type drives category |
| Asset Tags | Third-party security tools (Armis, Claroty, Medigate), manual tagging |
| Manufacturer | MAC address resolution from network discovery |
| Hostname | DNS, NetBIOS, Active Directory, endpoint agents |
| Software Inventory | Endpoint agents, vulnerability scanners |
| Open Ports | Network scans, traffic analysis |

### Asset Tag Analysis for Asset Categorization

Asset tags are key-value labels that help classify assets. Tags follow a prefix: value format where the prefix indicates the source or category, and the value describes the asset.

**Default Supported Prefixes**

The following tag prefixes are automatically recognized:

| **Prefix** | **Source** |
| --- | --- |
| `Device Type:` | Generic asset classification |
| `Asset Type:` / `Asset Subtype:` | Manual or CMDB classifications |
| `Armis Asset Type:` / `Armis Asset Category:` | Armis IoT security platform |
| `Orca Inventory Type:` | Orca cloud security |
| `Firemon:` | FireMon network security |

**Example Tags**

| **Tag** | **Resulting Classification** |
| --- | --- |
| `Device Type: MRI` | Medical asset → MRI |
| `Device Type: security cameras` | IoT Asset → Security Cameras |
| `Asset Type: server` | Servers |
| `Device Type: barcode scanners` | IoT Asset → Barcode Scanners |

**Custom Tag Prefixes**

Organizations using custom tagging conventions can request configuration of additional prefixes. Contact support to enable recognition of organization-specific tag formats.

### Improving Categorization Coverage

To reduce the number of Poor Visibility/Low-Fidelity assets, focus on enriching data based on asset type:

**For Servers and Desktops**

- Deploy endpoint agents to collect OS, hostname, and software inventory
- Integrate with cloud providers (AWS, Azure, GCP) for cloud VM classification
- Enable SNMP for network asset discovery

**For IoT, Medical, and OT Assets**

- Configure asset tags in third-party security tools (Armis, Claroty, Medigate)
- Use manual tagging to classify specialized equipment
- Ensure network visibility to capture MAC addresses for manufacturer identification

**For Cloud Assets**

- Enable cloud connectors with appropriate API permissions
- Apply consistent resource tagging in cloud environments
- Configure account-level integrations for complete visibility into IAM and serverless resources

## Asset Categorization: Samples by Type

| **Type** | **Subtype** | **Potential Indicators & Examples** |
| --- | --- | --- |
| **Serverless** | Messaging Service | Cloud Connector: `AWS::SNS::Topic`, `AWS::SQS::Queue` |
| **IoT** **Asset** | Automotive | Tags: `Device Type: automotives`, Firmware: `bmw_head_unit`, `honda_civic_firmware` |
| **Serverless** | Cloud Account | Cloud Connector: `AWS::Account::Account`, `Microsoft.Subscription/subscription` |
| **Serverless** | Compute | Cloud Connector: `AWS::Lambda::Function`, Tags: `Device Type: lambda` |
| **Cloud Security Infrastructure** | Identity and Access Management | Cloud Connector: `AWS::IAM::User`, `AWS::IAM::Role`, `GCP_IAM_USER`, `AZURE_IAM_USER` |
| **Container** | Workload / Image | Cloud Connector: `AWS::EKS::Cluster`, `Microsoft.ContainerInstance`, Tags: `Device Type: kubernetescluster` |
| **Serverless** | API Service | Cloud Connector: `Microsoft.Synapse/workspaces` (Mapped via Data Analytics/Query Service) |
| **Database** | In-Memory Data Store | Software: `Redis Server`, Tags: `Device Type: redis cache` |
| **Database** | Document Data Storage | Tags: `Device Type: cosmos db`, `Device Type: dynamodb` |
| **Database** | RDBMS | Cloud Connector: `AWS::RDS::DBInstance`, Tags: `Device Type: rds` |
| **Database** | Search Engine | Cloud Connector: `AWS::Elasticsearch::Domain`, Tags: `Device Type: elasticsearch` |
| **End-User Compute** | Physical | OS: `Windows 10/11`, `macOS`, Hostname: Contains "desktop" or "laptop", Manufacturer: Dell, Apple, Lenovo |
| **End-User Compute** | VDI | Manufacturer: VMWare, Xen, VBox, Parallels |
| **End-User Compute** | Physical Workstation | Hostname: `USER'S MACBOOK PRO` or contains `MBP` + Manufacturer Apple |
| **IoT** **Asset** | Barcode Scanner | Tags: `Device type: barcode scanners` |
| **IoT** **Asset** | Building Automation | Tags: Generic building automation tags |
| **IoT** **Asset** | POS System | Tags: Generic POS tags |
| **IoT** **Asset** | Security Camera | Manufacturer: Axis Communications, Tags: `Device Type: security equipment` |
| **IoT** **Asset** | Wearable Asset | Tags: `Device Type: wearables watches` |
| **IoT** **Asset** | Sensor | Tags: `Device Type: Sensor Instrument` |
| **IoT** **Asset** | Attendance System | Tags: `Device Type: generic iots attendance systems` |
| **Medical Asset** | Infusion Pump | Tags: `Device Type: medical infusion pumps` |
| **Medical Asset** | X-Ray | Tags: `Device Type: medical xrays` |
| **Medical Asset** | MRI | Tags: `Device Type: medical mri` |
| **Medical Asset** | CT | Tags: `Device Type: medical ct scanners` |
| **Medical Asset** | Patient Monitor | Tags: `Device Type: medical patient monitors` |
| **Medical Asset** | Nurse Call | Tags: `Device Type: medical nurse call` |
| **Medical Asset** | PACS | Tags: `Device Type: pacs/picture archiving` |
| **Medical Asset** | Medical Printer | Tags: `Device Type: medical printers` |
| **Multimedia Asset** | Gaming Console | Tags: `Device Type: multimedia game consoles` |
| **Multimedia Asset** | Projector | Manufacturer: Barco Projection Systems, Tags: `Device Type: multimedia projectors` |
| **Multimedia Asset** | Speaker | Tags: `Device Type: multimedia speakers` |
| **Networking Asset** | Router/Switch | OS: `cisco_meraki_mr`, Tags: `Device Type: networking switch` |
| **Networking Asset** | Access Point | OS: `cisco_meraki_mr74`, Tags: `Device Type: WAP Network` |
| **Networking Asset** | Firewall | OS: `paloaltonetworks_pan-os`, `f5`, Tags: `Device Type: security firewalls` |
| **Networking Asset** | CDN | Cloud Connector: `AWS::CloudFront::Distribution`, Tags: `Device Type: cloudfront` |
| **Networking Asset** | WAF | Cloud Connector: `AWS::WAF::Rule` |
| **Cloud Security Infrastructure** | Audit Logging | Cloud Connector: `AWS::CloudTrail::Trail` |
| **OT** **Asset** | HVAC | Tags: Generic HVAC tags |
| **OT** **Asset** | Power Management | Manufacturer: APC by Schneider Electric, Tags: `Device Type: Power Management` |
| **Printer/Fax/Scanner** | — | Manufacturer: Ricoh, Lexmark, Zebra, Sharp, Tags: `Device Type: printer`, `Device Type: scanner` |
| **Server** | Physical Server | Manufacturer: Any manufacturer that is NOT a Cloud or VM provider (e.g., NOT VMWare, NOT AWS) |
| **Server** | Cloud Virtual Machine | Cloud Connector: `AWS::EC2::Instance`, `Microsoft.Compute/virtualMachines`, Manufacturer: Amazon, Google |
| **Server** | On-Prem Virtual Machine | Manufacturer: VMWare, Xen, Ovirt, Microsoft |
| **Storage Asset** | On-Prem Storage | Manufacturer: PURE Storage, OS: Linux (combinatorial logic) |
| **Storage Asset** | Cloud Object Storage | Cloud Connector: `AWS::S3::Bucket`, Tags: `Device Type: s3` |
| **Cloud Security Infrastructure** | Network Security | Cloud Connector: `AWS::SecretsManager`, `Azure-Key-Vault`, Tags: `AWS Type: key vault` |
| **Handheld** | — | OS: `iOS`, `Android`, User Agents: iPhone/Android strings, Tags: `Device Type: iPad tablet`, `Device Type: Android Smartphones` |