Asset Inventory Reconciliation

Sources and keys

Method

1. Export each source with timestamps.
2. Normalize: lowercase hostnames, strip domain suffixes (keep FQDN separately), MAC format aa:bb:cc:dd:ee:ff, serial uppercase.
3. Match by strongest key first (serial / cloud instance ID / MAC), then hostname, then IP+time.
4. Produce a matrix of asset × source presence and identify gap categories:

import csv
def load(path, key):
    return {r[key].strip().lower().split(".")[0]: r for r in csv.DictReader(open(path))}
cmdb, edr, scan = load("cmdb.csv", "hostname"), load("edr.csv", "hostname"), load("scanner.csv", "hostname")
for host in sorted(set(cmdb) | set(edr) | set(scan)):
    print(host, "cmdb" if host in cmdb else "-", "edr" if host in edr else "-", "scan" if host in scan else "-")

Sustain

Automate weekly; feed gaps to owners as tickets; track coverage metrics (detection-coverage-metrics, edr-coverage-health).

Related skills

asset-criticality-tiering, edr-coverage-health, shadow-it-discovery, scan-result-triage

References

• CIS Controls v8.1 Control 1 (Inventory and Control of Enterprise Assets): https://www.cisecurity.org/controls/inventory-and-control-of-enterprise-assets
• NIST SP 1800-5 IT Asset Management: https://www.nccoe.nist.gov/it-asset-management