AI Search: What You Can Search For

AI Search: What You Can Search For

AI Search is flexible, but it helps to know which fields it understands so you can write better queries and troubleshoot when results aren’t what you expected. This page is your reference for everything AI Search knows about.

Hardware fields and software inventory are available only for devices that have checked in with the K12Panel Windows or ChromeOS agent. If a field shows no results, the device may not have reported that data yet. These fields work the same way in Cross Org Search as on the single-org Assets screen, with one exception noted under Classification & Location.

Device Identity

Populated for all assets, whether or not an agent is installed.

Classification & Location

AI Search understands your category and site hierarchy. On the single-org Assets screen, a search for a parent category or site automatically includes its children.

Cross Org Search difference: in cross-org mode, category and site searches match by name only — they do not automatically include child categories or sites.

Hardware Fields

Populated when a Windows or ChromeOS agent checks in. Fields are blank for devices that have never reported hardware inventory or for non-agent-managed assets.

Operating System

The system understands common shorthand: “Chromebook,” “Windows PC,” “Mac,” and “iPad” resolve to the correct OS filter.

Memory & Storage

RAM is stored in megabytes internally; natural phrasing like “4GB,” “8 gig,” or “16GB” is converted automatically.

Processor, Battery, and Display

Battery health is available only for devices whose agents report it; desktops won’t have it.

Network / MAC Addresses

By default a MAC search checks both adapters. The combined “any MAC” search is available on the single-org Assets screen only; in Cross Org Search, target the WiFi or Ethernet MAC specifically.

Active Directory Domain

Domain data is reported by the Windows agent. A device with no domain data is different from one confirmed on a workgroup — “not domain joined” returns only devices whose agents reported they are not on a domain.

Last Logged-In User

Example: “devices last used by jsmith.” This reflects the most recent user profile reported by the Windows agent at the last hardware check-in — it is not a real-time login indicator.

Windows Update Status

Populated when the Windows Update worker has run on a Windows asset. Not available on ChromeOS, Mac, or manual assets. A null value means “no data yet,” not “compliant.”

The pending count excludes driver and Defender definition updates by default (they’re noisy and often skipped). Driver count is tracked separately.

Antivirus & Defender

Populated when a Windows device reports antivirus inventory. Not available on ChromeOS, Mac, or manual assets. A blank value means “no data yet,” not “unprotected.”

Uncontained threats counts active Microsoft Defender detections that were allowed or whose remediation failed and that haven’t been acknowledged — the same number shown by the Threats column and the device’s Defender tab. See the Microsoft Defender Monitoring article for how this is collected.

Software Inventory

Finds devices by installed software, from the Windows agent’s software report (Windows only).

If a known-installed app returns nothing, the inventory may be stale, or the app may be listed under a different registry name — try a partial name (e.g. “Microsoft 365” instead of “Microsoft Office 365 ProPlus”).

Checkout & Assignment

Dates

“Last seen” reflects the last time the record was updated by an agent check-in. Manual assets that never had an agent show their record creation date.

Device State

By default AI Search returns Active and Inactive devices. You can ask explicitly for other states: active, inactive, archived, trashed, or on-ramp. “All devices” returns Active and Inactive (archived and trashed are excluded unless requested).

Agent Information

Example: “devices running agent version 4.2” or “agents older than 4.0.”

Organization (Cross Org Search only)

In Cross Org Search you can scope by organization name — for example “Windows 11 laptops at Riverside” or “devices with active threats except at Sunnydale.”

Combining Conditions

You can combine any of the above in one query (AND logic), for example:

• Dell Windows 11 laptops with more than 8GB RAM at Lincoln Elementary
• Chromebooks older than 4 years with battery health below 60%
• Unassigned Windows 10 devices not seen in 90 days
• Domain-joined computers without antivirus installed
• Windows devices with active threats running Defender as real-time

What AI Search Cannot Do

• Cannot search activity logs, audit records, or financial data — use Reports for those.
• Cannot search across organizations unless you’re on the Cross Org Search screen with cross-org access.
• Cannot search ChromeOS software — installed-app inventory is Windows-only.
• Results are bounded by your permissions; AI Search never grants access to assets outside your reach.
• Hardware fields require agent data — if an agent never checked in, those filters return nothing for that device.

Common Questions

Why does a field return no results?
The device likely hasn’t reported that data, or it’s a non-Windows/manual asset for a Windows-only field.

Does “not domain joined” include devices that never reported?
No. It returns only devices whose agents confirmed they aren’t on a domain.

Why can’t I find an app I know is installed?
The inventory may be stale, or the app is under a different registry name — try a partial name.

Does category/site search include child categories?
On the single-org screen yes; in Cross Org Search it matches by name only.

Can I search software on Chromebooks?
No. Software inventory is Windows-only.