Asset criticality

Asset criticality classifies your assets by how much they matter to your business. You define a small set of ordered levels, such as crown jewels, high value, standard, and low impact, and each level is filled by J1QL queries. An AI agent can propose the whole setup from what JupiterOne knows about your environment. You review every level and query before anything takes effect, and JupiterOne then keeps every asset's level up to date as your environment changes.

Criticality levels feed the Unified Vulnerability Management risk score, so vulnerabilities on your most critical assets rise to the top of the Prioritized view. Levels are also stored as properties on each asset, so you can use them in any J1QL query, alert rule, or dashboard.

How asset criticality works

• Levels are ordered from most to least critical. A setup has between two and six levels. Each level has a name you choose and a description of what losing those assets would mean to your business.
• Queries fill the levels. Each level is defined by one or more J1QL queries. An asset joins a level when it matches any of that level's queries.
• The most critical match wins. An asset that matches queries in more than one level gets the most critical of those levels.
• JupiterOne applies levels automatically. Your levels run every hour. Each run writes the level onto every matching asset and removes it from assets that no longer match, so new assets are classified without any action from you.
• Unmatched assets stay unclassified. An asset that no query matches carries no level.

Asset criticality is built for assets: hosts, devices, cloud resources, data stores, applications, identities, and similar entities. Findings, vulnerabilities, alerts, controls, and other record-like entities are not counted as assets, and the agent does not propose queries for them. A query you write classifies whatever entities it returns.

note

If you previously defined crown jewels with queries, those queries were carried into your asset criticality setup when the feature was released. Open Assets > Asset criticality to review them, edit them, or run the agent to build a new setup.

Prerequisites

• You need the Vulnerabilities: Admin or Full Admin Access: Admin permission to view and manage asset criticality. See UVM permissions.
• For the agent to propose a setup, your integrations must have ingested data about your environment. The more of your environment JupiterOne sees, the better the proposal.

Set up asset criticality

Navigate to Assets > Asset criticality. The first time you open the page, select how to start:

Option	What it does
Set up for me	The agent studies your environment and proposes a complete setup. Recommended for most accounts.
Start from our policy	The agent reads your asset management or classification policy and turns it into a setup that matches your environment.
Build it myself	You define the levels and write the J1QL queries yourself.

Let the agent propose a setup

1. Navigate to Assets > Asset criticality.
2. Select Set up for me.
3. Answer Do you already have classification levels?
   • Select No — start with the recommended model to use four levels: Critical, High, Medium, and Low.
   • Select Yes — we have our own to pick a common scheme, such as Tier 0–3, or to enter your own level names. Enter the names with the most critical level first. The agent uses your names everywhere.
4. Click Start analysis. The analysis usually takes one to two minutes.
5. When the analysis finishes, the Review your setup page opens. Nothing takes effect until you apply it.

Start from your policy

If your organization already has an asset classification policy, a tiering standard, or a business impact analysis, the agent can use it as the starting point.

1. Navigate to Assets > Asset criticality.
2. Select Start from our policy.
3. Click Upload policy and select your policy file, or paste the policy text into the text box. The file must be Markdown or plain text, up to 50,000 characters. Your browser reads the file, and only its text is sent to the agent.
4. Answer Do you already have classification levels? If your policy names its levels, select Yes — we have our own and enter them with the most critical level first.
5. Click Start analysis.

tip

If your policy is a PDF or Word document, export it as plain text or copy the sections that define your levels into the text box. Keep the sections that define your levels if the policy is longer than 50,000 characters.

Build it myself

Select Build it myself to open the Edit levels and queries page with an empty setup. See Edit levels and queries.

Review the proposal

The Review your setup page shows each proposed level, the business consequence it represents, and the queries that fill it. Each query shows a plain-language description, its J1QL, and how many assets it matches today.

On this page you can:

• Rename a level. Edit the level name and click Save name.
• Turn a level off to leave it out of the setup. A setup needs at least two levels, so you cannot turn off a level when only two remain.
• Change a query. Use Edit, Move to, or Remove query on any query, and click View matching assets to see which assets a query matches.
• Ask for changes. Describe a change in plain language, such as "exclude sandbox accounts," and the agent updates the proposal for you. See Ask the agent for changes.
• Click Undo edits to reverse your changes, Restore previous version to return to an earlier version of the proposal, or Discard proposal to start over.

The page also tells you when the agent changed its own draft, for example when a level was left out because the agent could not fill it, when a query was moved to a less critical level, or when a query's match count is an estimate. Read these messages before you apply.

Ask the agent for changes

On the Review your setup page, describe what to change:

• If your account has the JupiterOne AI assistant, click Ask for changes. The assistant opens so you can describe the change and keep refining the proposal in a conversation.
• Otherwise, enter the request in the box under Ask the agent for changes and click Send. A request can be up to 1,000 characters.

The proposal updates in place, and each level notes what changed. Nothing is applied until you apply the setup.

The agent can add, remove, move, and rewrite queries. It does not change level names or the number of levels. Rename or turn off levels by hand.

Preview and apply

1. On the Review your setup page, click Preview changes.
2. The Preview changes page shows what the first run will do: an estimate of how many assets each level will classify, how each level is written onto your assets, and the expected distribution of your assets across levels.
3. Click Apply setup. JupiterOne saves your setup and starts a run to classify your assets.

Monitor your levels

After you apply a setup, Assets > Asset criticality shows two tabs.

Overview summarizes your classification:

• Total assets, Classified, the number of assets at your most critical level, and Last run
• A Distribution chart of your assets across levels
• A table of your levels with their Queries, Assets, change over the last seven days (Δ 7d), and Status

Select a level to open its page, which lists the level's queries and a sample of its matched assets. Click View all to see every asset at that level.

Run history lists every manual and setup run, and every scheduled run that changed something, with what triggered it (Scheduled, Manual, or Setup), how many assets changed level, and who started it. Run history keeps up to 500 runs from the last 90 days.

Run your levels now

Your levels run every hour. To run them immediately, click Run now on the Overview tab. Results appear in Run history within a few minutes. You can start a manual run once every 15 minutes.

The first run classifies every matching asset. After that, each run applies up to 100,000 changes. When more assets need to change level, for example after you rewrite a broad query, the run shows Partial — continues on the next run and the remaining changes are applied over the following runs.

Edit levels and queries

To change your setup after you apply it, click Edit levels on the Overview tab.

1. On the Edit levels and queries page, list your levels with the most critical first. You can have between two and six levels, and each level needs a unique name.
2. For each query, enter a Query name, pick the level it belongs to, and write its J1QL. Click Preview matches to check what the query returns.
3. To add a query, click Add query and select Write J1QL, or select Draft with AI to describe the assets you want in plain language and let the agent draft the queries.
4. Click Save changes. Saving starts a run, which begins once at least 15 minutes have passed since the previous run.

warning

A level's name determines the value written onto its assets. Renaming a level re-tags every asset at that level, starting with the next run, so update any queries, alert rules, or dashboards that filter on the old value.

To keep a query in your setup without applying it, turn the query off. A level whose queries are all off shows All queries off in the Status column.

When you remove a query, its assets lose the level on the next run unless another query still places them there.

Draft queries with AI

Select Draft with AI when you add a query, then describe what belongs in the level, for example "systems in PCI scope." If your account has the JupiterOne AI assistant, the request opens there. Otherwise, click Draft queries. The agent drafts up to five queries for each request. Review each proposed query, then click Accept change or Accept all. Nothing is saved until you click Save changes.

Query requirements

Each query must return the assets it classifies:

• Leave out the RETURN clause, and JupiterOne adds one for you when you save. The query classifies the entities of its first term. If the query traverses to other entities, give the first term an alias, for example FIND Host AS h THAT RELATES TO DataStore.
• If you write your own RETURN, it must return one entity's _id as entityId, for example FIND Host AS h RETURN h._id AS entityId.
• Do not use LIMIT or SKIP. A query defines the complete set of assets for its level, so any asset it leaves out loses the level.
• A query can be up to 1,024 characters long.
• A setup can hold up to 50 queries across all levels.

Run the agent again

To rebuild your setup from scratch, click Set up again on the Overview tab. The agent analyzes your environment again and produces a new proposal. Your current levels and queries stay exactly as they are until you apply the new proposal. Applying it replaces all of them.

How the agent builds a proposal

The agent judges criticality by consequence: what breaks, and how badly, if an asset is lost, degraded, or compromised.

• It works from a summary of your environment. The agent reads which classes and types of assets you have, their property names and values, how many of each exist, and the names of your integrations and accounts. If you start from your policy, it also reads the policy text. The agent runs each proposed query against your data where it can, so you see real match counts. When it cannot, the review page says the count is an estimate.
• It does not use exposure or vulnerability signals. Internet exposure, vulnerability counts and severity, risk scores, cost, size, and age do not determine a level. Your risk score already accounts for exposure and vulnerabilities, so using them again here would count them twice.
• The more critical levels hold production assets. When your data marks assets as non-production, such as development, test, and sandbox resources, queries in every level except the least critical exclude them, and those assets go to the least critical level. Queries that cannot be limited this way are flagged on the review page.
• Stale devices stay out of the more critical levels. Device queries in every level except the least critical exclude devices that have not been seen in 180 days. Devices with no last-seen date are kept.
• The top two levels come from high-consequence assets. In a setup with three or more levels, the two most critical levels are built from assets whose compromise has the widest consequence, such as root and administrator accounts, production data stores, backups, credentials, and workloads with privileged access. To place specific systems, such as your payment platform, in a top level, add or move their queries on the review page.
• People and devices are covered. The agent adds queries that place people and devices in the least critical level when no other query covers them, so they are classified rather than left out.

Review every proposal before you apply it. The agent can make mistakes, and it can only work with the data your integrations have ingested. For how JupiterOne AI handles your data, see JupiterOne AI.

Query criticality in J1QL

JupiterOne writes two properties onto every classified asset:

Property	Value	Example
j1.criticality	The level's tag, made from its name: lowercase, with each run of characters other than a–z and 0–9 replaced by one hyphen, and cut to 40 characters	crown-jewels for a level named Crown jewels
j1.normalizedCriticality	The level's rank, where 0 is the most critical level and the value counts up by one for each level	0 to 3 in a four-level setup

Use j1.criticality to select a specific level, and j1.normalizedCriticality to compare across levels. Adding, removing, or reordering levels renumbers j1.normalizedCriticality, and renaming a level changes its j1.criticality value.

Find every asset at your most critical level:

FIND * WITH j1.normalizedCriticality = 0

Find assets at a level named Crown jewels:

FIND * WITH j1.criticality = 'crown-jewels'

Find hosts in your two most critical levels:

FIND Host WITH j1.normalizedCriticality <= 1

Count assets by level:

FIND * WITH j1.criticality != undefined AS e
RETURN e.j1.criticality AS level, count(e) AS total

Find unclassified assets:

FIND * WITH j1.criticality = undefined

JupiterOne manages the j1.criticality and j1.normalizedCriticality properties. Values you write to j1.* properties through the entity API are ignored. To change an asset's level, change the queries that place it.

Limits

Item	Limit
Levels	2–6 per setup, each with a unique name of up to 64 characters
Queries	50 across all levels
Query length	1,024 characters
Policy text	Markdown or plain text, up to 50,000 characters
Scheduled runs	Every hour
Changes per run	Every matching asset on the first run, then up to 100,000 per run
Manual runs	One every 15 minutes
Draft with AI	Up to five queries per request
Run history	Up to 500 runs from the last 90 days
Unapplied proposal	Kept for 7 days after its last change, with up to 5 previous versions
Change request	1,000 characters

Troubleshooting

Symptom	Cause	Resolution
The analysis ends with "There is not enough information about this environment yet to propose a setup."	JupiterOne has not yet collected enough data about your environment	Try again once more of your integrations have run, or select Build it myself
A level you asked for is missing from the proposal	The agent could not fill that level. Your level names are applied in order to the levels that remain, so the names listed as left out are the least critical ones.	Check each level's name against its queries before you apply. To add the level back, apply the setup, click Edit levels, and then click Add level.
The analysis ends with "The analysis could not be completed. Start it again." or "This run stopped unexpectedly. Start the analysis again."	The analysis was interrupted	Start the analysis again
An asset has the wrong level	An asset takes the most critical level that has a query matching it	Click Edit levels and use Preview matches on that level's queries to find the one that matches the asset. Edit the query to exclude it, or move the query to a different level.
Run now is unavailable	A run is in progress or queued (saving your setup queues one), the previous run's changes are still being applied, or a run was requested in the last 15 minutes	Wait for the current run to finish, or try again after the time shown
A run shows Partial — continues on the next run	More than 100,000 assets needed to change level in one run	No action needed. The remaining changes apply on the following runs.
The Δ 7d column is empty	Your setup has less than seven days of run history	The column fills in once there are seven days of run history
An alert rule or dashboard stopped matching after you changed your levels	Renaming a level changes its j1.criticality value, and adding, removing, or reordering levels renumbers j1.normalizedCriticality	Update the rule or dashboard to filter on the new values

Related topics

• Risk scoring
• Unified Vulnerability Management
• UVM permissions
• Smart classes
• JupiterOne AI