Asset correlation is how Security links security events — alerts, detections, IOC matches — to the known devices and users in your fleet. When a security event carries a device ID or host identifier that matches a device enrolled in RMM, Security surfaces that device's context directly in the alert and incident detail views.
This enrichment lets analysts move from "something happened" to "something happened on this specific client's device running this OS with these installed packages" without switching tools.
How Events Are Linked to Assets
Security receives events from two directions:
From RMM agents — endpoint telemetry is submitted with a device ID embedded in the request. Security stores this device ID on each endpoint event and uses it to look up asset details from RMM when displaying alerts.
From cloud connectors — events from M365, Google Workspace, and Azure carry user accounts, hostnames, or IP addresses. Security normalizes these into the event record. When the normalized hostname or IP matches a device known to RMM, the link is made automatically.
If no match is found, the event still appears in the alert — it just shows the raw identifier (hostname, IP) without the enriched device record.
What Enrichment Adds to an Alert
When an alert is correlated to a known asset, the alert detail view shows:
- Device name — the device's display name from the fleet
- Client org — which organization this device belongs to
- RMM link — a direct link to the device record in RMM for configuration details, installed software, and patch status
- IOC match context — if the alert was triggered by an IOC match, the matched indicator and its severity are shown alongside the device
On an incident, all linked alerts with correlated assets are shown in the timeline with their device context.
Fleet Intel
Fleet intel aggregates match data across your entire fleet:
- Per-IOC stats — how many times each IOC has matched across all devices in the last 30 days, and when the last match occurred
- Per-MITRE technique stats — which ATT&CK techniques have been observed, how often, and on how many devices
Access Fleet Intel from Security → Fleet Intel. Use it to identify IOCs or attack patterns that are appearing across multiple clients — a signal that a campaign is active in your environment rather than an isolated incident.
Vulnerability-to-Asset Mapping
RMM sends software inventory data to Security, which cross-references it against CVE feeds. When a CVE matches an installed software version on a device, a vulnerability record is created and linked to that device ID. You can view per-device CVE exposure from the Vulnerabilities section.
Each vulnerability-device record tracks the installed version detected, when the CVE was first seen on that device, and remediation status.
IOC Matches
When the IOC matcher finds a match, it records:
- Which IOC matched (type, value, severity)
- Which device produced the matching event
- The match evidence (event data that triggered the match)
- When the match occurred
IOC matches appear as alerts in the queue and are also visible under IOCs → Matches for a full list per indicator.
FAQ
An alert shows a device IP but no RMM link. Why? The IP address in the event does not match a device currently enrolled in RMM for that org, or the device is enrolled under a different IP. If the device is in your fleet, verify the RMM agent is active and reporting. You can also look up the IP manually in Threat Hunt.
Can I manually link an alert to a device? Not directly on the alert. The link is established through the device ID or normalized hostname in the event data. If the event lacks this identifier, the alert will not have an asset correlation.
Does asset correlation work for user accounts, not just devices? Events that carry a user account (e.g., M365 sign-in events) are stored with the user identifier and can be queried in Threat Hunt. The Intelligence section provides a unified user view that aggregates security events, risk score (from Defend), and IOC matches for a given user account.