What do you run across every cloud, in one list?
Cloud asset inventory across seven clouds and 549 services, with the links between resources mapped.
The discovery engine is the foundation every other engine reads from: continuous, read-only enumeration of every resource across seven clouds and 549 services, with the relationships between them modelled as a graph.
- posture rules
- 9,853
- cloud providers
- 7
- cloud services
- 549
- compliance frameworks
- 78
Ask three teams how many cloud accounts the company has and you will get three numbers.
The spreadsheet is a year old, the tagging standard was adopted by two of nine teams, and the account someone opened for a proof of concept in 2022 is still running, still billed, and still has a production database in it. Every security control you own applies only to the resources you know about.
Asset Inventory & Discovery in two minutes
Voices are AI-generated. More short Q&A videos: Onam Estate
How Asset Inventory & Discovery works
- 01
Discovery enumerates every resource across AWS, Azure, GCP, OCI, Alibaba Cloud, IBM Cloud and Kubernetes (549 services in total) using read-only credentials.
- 02
Each resource is normalised into a shared model, so an AWS security group and an Azure network security group are comparable objects rather than two vendor formats.
- 03
Relationships are modelled explicitly: which instance sits in which subnet, which role is assumed by which function, which volume is attached where. Together they form the graph that attack-path analysis walks.
- 04
Discovery runs on every scan, so new resources appear in inventory at the next scan and deleted resources are retired rather than lingering.
- 05
Every other engine reads from this inventory, which is why a resource cannot be evaluated by one engine and invisible to another.
What you see in the console
- Unified inventory across seven clouds and 549 services
- Normalised resource model
- comparable objects across providers
- Relationship graph
- the dependency map attack paths are computed on
- Refreshed on every scan, with new resources picked up at the next scan
- Untagged, unowned and orphaned resource reports
- Multi-account and multi-subscription rollup in one view
- Resource history
- what changed, and when
- Coverage reporting
- which accounts and regions are being scanned
Asset Inventory & Discovery in the real console.
A recreation of the Onam console with sample data — the screens and finding types your team works with.
Questions we get a lot
See Asset Inventory & Discovery on your own cloud
Book a 30-minute demo. We walk through it on sample data, or on one of your accounts if you want to connect it.