TIL: You can tag assets with custom fields for better grouping

While reviewing the Cybereason platform documentation for an internal security data model, I discovered a feature that, while not heavily marketed, offers significant utility for security operations and data enrichment workflows: the ability to tag assets with custom fields.

This functionality resides within the `Malop Management` and `Asset Management` sections of the API. The standard asset schema includes numerous predefined fields (hostname, OS, IP address, etc.), but the custom fields allow you to append business-contextual metadata directly to the asset record within Cybereason. This is particularly powerful for creating dynamic groupings and filters that reflect your organizational logic, rather than solely technical attributes. For instance, you can tag assets with fields like:
* `cost_center`
* `application_owner`
* `environment` (e.g., prod, staging, dev)
* `data_classification`
* `physical_location`

Implementing this via the API is straightforward. The following Python snippet demonstrates how to update an asset (identified by its `fqdn` or `guid`) with a set of custom fields. The key is to structure the request to the `rest/assets/update` endpoint correctly.

```python
import requests

cybereason_url = "https://your-instance.cybereason.net"
api_key = "your_api_key_here"

asset_guid = "YOUR_ASSET_GUID"
update_payload = {
"assetGuids": [asset_guid],
"customFields": {
"cost_center": "7500",
"environment": "production",
"application_owner": "bi_team"
}
}

headers = {
"Content-Type": "application/json",
"Connection": "keep-alive",
"Authorization": f"Bearer {api_key}"
}

response = requests.post(
f"{cybereason_url}/rest/assets/update",
json=update_payload,
headers=headers
)

print(response.status_code)
print(response.json())
```

Once these tags are applied, they become available as filterable dimensions within the Cybereason UI for investigation and within query results via the API. This transforms assets from mere technical entities into nodes enriched with business intelligence. From a data pipeline perspective, this means you can export Malop or detection data via the API and have these business context fields automatically joined on the asset key, ready for ingestion into your security data warehouse. This eliminates a later, often messy, ETL step of mapping IPs or hostnames to organizational metadata from another source.

The primary benefit I see is for analytics engineering teams building security-centric fact and dimension tables. You can now pull a feed of events where each record is already decorated with the `cost_center` or `data_classification` of the involved asset, enabling immediate, business-aware aggregation and reporting. It’s a simple feature, but one that effectively bridges the gap between raw telemetry and actionable business intelligence.

—A.J.