Search
One query language for every cloud, a view for every resource type, asset groups, change history and CSV export.
The inventory's search bar takes a query in AssetHermit's query language. The same language defines asset groups and the audit rules, so a rule's findings or a group's members are one click from the inventory. As you type, the search bar completes properties, operators and the values your assets hold, and marks any part of a query that can't match. Prefer forms? The query builder edits the same query one term at a time.
Writing a query
A query is terms written property:value. There is no free text: every term names a property, so to search by name write $name:value. Values are case-sensitive.
| Query | Means |
|---|---|
$provider:aws $region:eu-north-1 | Terms side by side must all match |
$provider:aws OR $provider:gcp | OR, in capitals, matches either side |
-$tag:owner | A minus negates a term, or a group in parentheses |
$region:eu-west-1,eu-north-1 | Commas in a value match any of them |
$name:web-* | * is a wildcard |
$name:"my bucket" | Quotes hold spaces and special characters |
$firstSeen:>2026-09-01 | Numbers and dates compare with >, >=, < and <= |
$lastSeen:<now-30d | Dates can be relative to now, in days (d) or hours (h) |
$type:compute.vm order by $name | order by comes last, asc or desc |
Common properties
Properties that start with $ work the same on every cloud. Without order by, results are ordered by $name.
| Property | Is |
|---|---|
$provider | The cloud: aws, gcp or azure |
$type | The normalized type, the same on every cloud, such as compute.vm (see Resource types) |
$nativeType | The cloud's own type as provider/service/resource: aws/ec2/instance, gcp/compute/instance |
$name | The asset's name |
$id | Its native ID (an ARN, a full resource name, an ARM ID) or AssetHermit's ID for it |
$region | Its region, or global for assets in no region |
$assetSource | The asset source's ID or name |
$account | The account's ID (AWS account, GCP project, Azure subscription) or name |
$tag | A tag key, or key=value, from every cloud's tags or labels |
$firstSeen | When AssetHermit first saw the asset |
$lastSeen | When it last saw it |
$assetGroup | An asset group the asset is in, by ID or name |
$usage | A usage metric over the last 14 days, as $usage.<metric>.<statistic>, compared as a number: $usage.cpu.p95, $usage.requests.sum |
$idle | true when the asset ran the last 14 days without activity, from its cloud's own metrics |
$lastActive | The last day its activity was above its type's floor, as far back as the cloud keeps metrics |
Every other property
Any other property is a path into the data the cloud returned for the asset: AWS's API responses, GCP's Cloud Asset Inventory data and Azure's resources as ARM writes them. So anything a cloud reports can be searched, not only what every cloud shares.
- Keys are joined with dots, at most 5 deep, and written in camelCase:
roleArnmatchesRoleARNandrole_arn. []marks an array:securityGroups[].groupId:sg-1*matches when any element does.- Braces tie terms to one element:
tags[]{key:env value:prod}needs one tag with both. path:*finds assets that have the path at all.
Examples
| Query | Finds |
|---|---|
$type:compute.vm $region:eu-* | Virtual machines of every cloud in regions starting with eu- |
$nativeType:aws/ec2/* | Every EC2 type |
$idle:true $tag:env=prod | Production assets idle for the last 14 days |
$type:compute.vm order by $usage.cpu.p95 desc | Virtual machines, busiest first by their CPU's 95th percentile |
$provider:aws $type:storage.disk -encrypted:true | EBS volumes that aren't encrypted |
$tag:env=prod -$tag:owner | Assets tagged env=prod without an owner tag |
-$tag:* | Untagged assets |
$account:111122223333 $type:network.firewall | Security groups in one AWS account |
$nativeType:aws/rds/db-instance engine:postgres engineVersion:13.* | RDS PostgreSQL 13 instances |
$nativeType:aws/ec2/security-group ipPermissions[]{fromPort:22 ipRanges[].cidrIp:0.0.0.0/0} | Security groups with one rule that opens port 22 to the internet |
$nativeType:aws/iam/user passwordLastUsed:<now-90d | IAM users whose password wasn't used in 90 days |
$firstSeen:>now-7d | Assets first seen in the last 7 days |
$type:compute.vm OR $type:compute.function | Virtual machines or functions |
$name:"web server*" | Names starting with the phrase web server |
$type:storage.bucket order by $name desc | Buckets, Z to A |
With the AI assistant turned on, the search bar's Ask mode turns a question in plain words into a query, which you run or edit.
Views
The main inventory shows the common properties. Each resource type also has a view of its own, such as aws/ec2/instance, with every property its cloud returns as a column, and facets on them. The list of types shows how many of each your workspace holds.
Ready-made views start you off, such as public buckets, stopped virtual machines, untagged resources and unattached disks, each a query across all three clouds.
Asset groups
An asset group is a name and a query: an asset is in the group while the query matches it, and can be in any number of groups. $assetGroup then works like any property, so groups can be searched, faceted and shown as a column:
$assetGroup:Production -$tag:owner- A group can name other groups, 3 deep at most:
$assetGroup:Production $assetGroup:"Payments team". Renaming a group updates the queries that name it. - Add a single asset to a group, or leave one out, from the asset's page, up to 1,000assets a group.
- Findings and cost reports can be narrowed to a group, and costs grouped by it.
- An edited group applies at once, to every asset source of the workspace.
- Groups are labels, not access control: a group never limits what a member of the workspace sees.
Change history
Each sync takes a full snapshot of the asset source and compares it with the one before. A new asset is recorded as created, a changed one as updated with what changed, and one that's gone as deleted. Changes lists the last30 days across the workspace, and each asset's page has its own timeline. A deleted asset can still be opened, as it was before it went.
Nothing a sync finds shows until the sync finishes. If AssetHermit can't read part of a cloud during a sync, such as an account that's missing a permission, the assets it couldn't read are kept as they were and marked stale, rather than recorded as deleted.
A workspace admin sets how often asset sources sync (every 12 or 24 hours; 24 by default) and how long asset data is kept (30, 90 or 180 days; 30 by default), within what the workspace is subscribed to. Stop sync stops a sync, leaving the data as the last finished sync left it.
Sync now starts a sync at once, up to 3 times a source a day and 30 minutes apart. It draws 5 of your organization's credits for each account the source syncs. A source's first sync and a retry after a failed sync draw none. Scheduled syncs never draw credits, and go on when the credits run out.
CSV export
Export CSV in the inventory downloads every asset that matches the current search; in a type's view, with the columns you see. Cost reports export the same way.