Asset Inventory

Overview

The Asset Inventory is your catalog of every authentication asset OrgGuard has discovered — certificates, Connected Apps, Auth Providers, Named Credentials, External Credentials, and Scheduled Jobs. You use it to see what’s in your org, check expiration dates, assign owners, and drill into any asset’s details.

Who this page is for

Salesforce admins who own certificate and integration governance, or security/IT ops staff who need to inventory auth assets and keep them from silently expiring.

The Inventory experience is split across screens that work together:

• Inventory Overview (Dashboard) — at-a-glance metrics and scan status
• Inventory List — the full searchable, paginated asset table
• Asset record page — clicking a row opens the asset’s standard Salesforce record page. For certificates this renders the rich Certificate detail view with Certificate Info, Blast Radius, Ownership, Alert History, and Findings tabs. Other asset types currently render that same certificate-style layout (see Known Issues in the Roadmap).

---

What you’ll see

Inventory Overview (Dashboard)

The dashboard header shows the card title Inventory Overview, the Updated timestamp, and a Refresh button. The page auto-refreshes every 5 minutes.

Below the header:

• Metric cards (5 tiles)
  • Total Active Assets — every operational (non-deprecated) asset; counts assets whose DiscoveryStatus__c is Discovered or Partial
  • Expiring in 30 Days — rendered in a warning color when non-zero
  • Expiring in 60 Days — informational
  • Expiring in 90 Days — planning horizon
  • Missing Owners — rendered in an error color when non-zero; these assets have no assigned owner and therefore can’t receive targeted ownership notifications
• Assets by Type table — counts by Certificate / Connected App / Auth Provider / Named Credential / External Credential / Scheduled Job
• Last Discovery Scan — Date, Status, and Assets Seen for the most recent scan

Each metric has a help tooltip (hover the ? icon) explaining what it measures.

If no assets have been discovered, you see an empty state prompting you to run your first scan from the Coverage Summary tab or the Setup Wizard.

Inventory List

The list screen header shows Asset Inventory with an Updated timestamp and a Refresh button.

Below the header:

• Search Assets — free-text input; matches on asset name
• Asset Types — dual-listbox with six categories (Certificate, Auth Provider, Connected App, Named Credential, External Credential, Scheduled Job); move options between Available and Selected to filter
• Clear Filters — appears only when a search term or type filter is active
• Data table — 8 columns:
  • Name, Type, Owner, Expiration Date, Days to Expiry, Severity, Status, Last Discovered
  • The Status column shows the asset’s DiscoveryStatus__c value (see Status reference below)
  • Days-to-Expiry cells color-code: red at ≤ 30 days, amber at ≤ 60 days
  • Severity cells color-code: red for Critical/High, amber for Medium
• Pagination — 25 rows per page; Previous / Next buttons plus a “Showing X–Y of Z” label

Click any row to open that asset’s standard Salesforce record page.

Asset record page

Clicking a row navigates to the asset’s standard TrackedAsset__c record page — there is no custom OrgGuard detail component layered on top of the list. For certificates, that record page renders the rich Certificate detail view, which has a Refresh button in the header and five tabs:

Read-only by design

The asset record page is read-only. The standard Edit button is intentionally suppressed and the discovered fields are display-only, so auto-discovered values can’t be hand-edited and drift on the next scan. OrgGuard User and Auditor roles have read-only access to assets; only Admin can change governance details (the asset Owner), via the Ownership tab below.

Tab	What it shows
Certificate Info	Subject, Issuer, Fingerprint (SHA-256), Expires, Source, and (where available) Serial Number, Key Size, Signature Algorithm, and SANs
Blast Radius	A table of the configurations (Named Credentials, Auth Providers, SAML configs, Connected Apps) that depend on this certificate, or an empty state
Ownership	Current Owner, whether an owner override is active, and a Change Owner button — OrgGuard notifies this user’s email on findings
Alert History	A table of audit events recorded for this certificate, or an empty state
Findings	A table of every finding linked to this certificate, with an Acknowledge button per open finding (or a success message if none exist)

Note

Non-certificate asset types currently render this same certificate-style layout on their record page — see Known Issues in the Roadmap.

---

Common tasks

Task: Find an asset by name

Who can do this: OrgGuard User (read access to TrackedAsset__c) Prerequisites: At least one discovery scan has completed.

1. Open the Inventory tab.
2. In the Search Assets box, type part of the asset’s name.
3. Results filter as you type; the list resets to page 1.
4. Expected result: the table shows only assets whose name matches your search term.

Caution

Search matches on asset Name only. To find assets by Owner, Source, or ExternalId__c, open the underlying TrackedAsset__c tab and use a standard Salesforce list view.

Task: Narrow the list to specific asset types

1. In the Asset Types dual-listbox, double-click (or use the arrows to move) the types you want to include from Available into Selected.
2. The list reloads automatically on every change.
3. Expected result: only assets with the selected types appear.

To reset filters, click Clear Filters. This button is only visible when at least one filter is active.

Task: Export to CSV

Who can do this: OrgGuard User (read access to TrackedAsset__c). Prerequisites: At least one row in the current filter view.

1. Apply the Asset Type filter to scope the export.
2. Click Export CSV in the header.
3. Your browser downloads a file named orgguard-inventory-YYYY-MM-DD.csv (UTF-8 encoded, comma-delimited).
4. Expected result: the CSV contains every asset matching the selected Asset Type filter (the search box and current page do not narrow the export), up to 10,000 rows, with one header row plus one data row per asset.

Caution

The button is disabled when no rows match the current filters. Hover over the button to see why — typical reason is filters are too narrow. Clear or relax filters and try again.

Note

Exports are capped at 10,000 rows per call (server-side limit). The export honors only the Asset Type filter — the search box and the current page are ignored. If your inventory exceeds 10,000 operational assets, narrow by Asset Type to chunk the export. The success toast reports the total row count pre-filter.

Task: Open an asset’s details

1. In the Inventory List, click any row.
2. The asset’s standard record page opens. For a certificate, the Certificate Info tab is active.
3. For certificates, click any of the five tabs — Certificate Info, Blast Radius, Ownership, Alert History, Findings — to move between panels.
4. Use your browser’s Back button to return to the inventory.

Task: Change a certificate’s Owner

Who can do this: OrgGuard Admin — the Change Owner action requires the OrgGuard Admin permission set. Prerequisites: The certificate’s record page is open, and the user you want to assign must be an active Salesforce user in this org.

1. Open the certificate’s record page (click its row in the Inventory List).
2. Open the Ownership tab and click Change Owner.
3. In the modal, search for and select the new owner.
4. Click Save.
5. Expected result: the Current Owner field updates and the override is marked active; the asset no longer counts toward the Missing Owners metric on the dashboard.

Caution

There is no Assign Owner or Edit action on the inventory list itself, and ownership changes are wired up only on the certificate record page. Other asset types do not yet expose an in-app owner-change control.

Tip

When you assign an Owner, OrgGuard routes finding notifications for this asset (expiry, failures, and other policy violations) to that user’s email. Until an owner is assigned, ownership alerts cannot be targeted and the asset counts toward Missing Owners.

Task: Refresh the inventory manually

1. Click Refresh on the dashboard or the list.
2. Expected result: the page reloads the latest data; the Updated timestamp changes.

Both pages also auto-refresh every 5 minutes while the tab is open.

---

Status and Severity reference

The asset’s discovery state is stored in DiscoveryStatus__c:

DiscoveryStatus__c value	Meaning
Discovered (default)	Asset was found by a discovery provider and all expected fields were populated.
Partial	Asset was found but some fields could not be populated (e.g. InboundMTLS cert details unavailable).
Manual	Asset was supplemented manually rather than auto-discovered.
Deprecated	Asset is intentionally retired. Use this instead of deleting discovered assets.
Unknown	Metadata insufficient to classify — pre-classification state.

Discovered and Partial are the operational statuses; Total Active Assets and the inventory list count assets in these two states.

The asset’s Severity badge is derived from its related open findings — there is no severity field stored on the asset itself. The badge reflects the highest-severity open finding linked to the asset:

Severity badge	What it typically means
Critical	An open Critical finding (e.g. expired, or a critical violation).
High	An open High finding (e.g. a high-priority policy violation).
Medium	An open Medium finding that needs attention.
Low	An open Low finding. Plan ahead.

Finding severity is set by policy evaluation — see Policies for how windows map to severity.

---

Troubleshooting

Symptom	Likely cause	Fix
Inventory is empty	No discovery scan has completed yet	Trigger a scan from the Setup Wizard or the Coverage Summary page.
Asset count lower than expected	Some asset types need additional permissions to discover	Check Coverage Summary for the Discovery Confidence of each type; Low or Medium confidence may require manual supplementation.
Clicking a row does nothing	User lacks read access to the TrackedAsset__c record	Verify the user has the OrgGuard User permission set — see Permission Sets.
Change Owner picker shows no results	Searched user is inactive, frozen, or outside the current sharing scope	Confirm the user is Active in Setup → Users and within the correct sharing rules. The Change Owner picker is on the certificate’s Ownership tab.
Dashboard metrics stale	Page renders cached data	Click Refresh, or wait for the 5-minute auto-refresh.
”Error loading assets” toast	Apex callout failed or permissions missing	Re-check permissions (see Permission Sets). OrgGuard Admin: enable Support Mode in Diagnostic Logging and retry to capture the error. Others: email support@orgguard.com with the toast text and the affected user’s permission set.

---

FAQ

Can I delete a discovered asset? Discovered assets are read by OrgGuard on every scan and would simply reappear after deletion. The OrgGuard asset record page is read-only (its Edit button is intentionally suppressed), so you don’t retire assets there. To deprecate one while preserving its finding history, an Admin sets DiscoveryStatus__c = Deprecated using a standard Salesforce tool — a list view inline edit, Data Loader, or the standard TrackedAsset__c object tab. (A dedicated in-app deprecate action is tracked for a future release.)

What does the Is Active field mean? Is Active (IsActive__c) is a plain editable checkbox that defaults to true. It is not a formula derived from DiscoveryStatus__c — it can be set independently. To scope by discovery state, filter on DiscoveryStatus__c directly (operational assets are Discovered or Partial).

Who gets notified about an asset’s findings? The asset’s assigned Owner (a Salesforce user). When OrgGuard raises a finding (expiry, failure, or another policy violation) and the policy has Notify Asset Owner enabled, it emails that user. Assign or change the owner from the Ownership tab. If no owner is assigned, the asset appears under Missing Owners and can’t receive targeted alerts.

Why does a certificate show “Unknown” expiration? Salesforce does not always provide an expiration date for all certificate types. Open Coverage Summary to understand which fields could and couldn’t be discovered for that asset type and why the gap exists.

Can I export the inventory to CSV? Yes. Click Export CSV in the Inventory List header. The file downloads with the filename orgguard-inventory-YYYY-MM-DD.csv and contains every asset matching the selected Asset Type filter (the search box and current page do not narrow the export), up to 10,000 rows. The button is disabled when no rows match — adjust filters first. See Task: Export to CSV above for the full procedure.

Why do the dashboard and the list sometimes disagree on count? The dashboard’s Total Active Assets counts operational assets (DiscoveryStatus__c of Discovered or Partial); the list shows assets matching your active filters. They will differ if you’ve narrowed the list by type or search term.

How often does OrgGuard re-scan? On the schedule you set in the Setup Wizard (default: daily). To change it, see Scheduled Jobs.

---

Related

• Policies — define what triggers findings on these assets
• Findings — lifecycle and bulk actions for policy violations
• Coverage Summary — understand what can and can’t be auto-discovered
• Scan Management — trigger, monitor, and diagnose scans
• Permission Sets — who can read, edit, and administer assets
• Troubleshooting · FAQ — cross-feature reference