Skip to main content

Nozomi Networks

Visualize your Nozomi Networks Vantage OT, IoT, and IT assets in the JupiterOne graph. Ingest the devices discovered on your operational-technology network along with their network security alerts and CVE-backed vulnerabilities, and monitor your OT/ICS security posture through queries and alerts.

Installation​

The Nozomi Networks integration ingests your Nozomi Vantage asset inventory, network security alerts, and CVE-backed vulnerabilities using the Vantage REST and pipe-query APIs. It authenticates with a Vantage API key (a key name and key token), which Vantage exchanges for a short-lived bearer token, then reads nodes (devices), alerts, and node CVEs to build a graph of your OT/IoT/IT environment.

Prerequisites​

  • A Nozomi Networks Vantage account, and the base URL you use to reach the Vantage web UI (for example, https://<tenant>.nozominetworks.io).
  • A Vantage user with permission to view the assets, alerts, and vulnerabilities you want to ingest. An API key inherits the data-access permissions of the user that owns it.
  • A Vantage API key (key name and key token) — see below.
  • Access to JupiterOne with permission to configure integrations.

Obtaining a Nozomi API key​

  1. Sign in to Vantage as the user who will own the API key. The key inherits that user's data-access permissions.
  2. Select Profile in the top navigation bar, then select API Keys.
  3. Generate a new API key and record its Key Name and Key Token.
caution

The key token is displayed only once, at generation time. If you lose it, you must generate a new API key, so store the token securely.

For more detail, see the Nozomi API key authentication documentation.

Configuration in JupiterOne​

To install the Nozomi Networks integration in JupiterOne, navigate to the Integrations tab in JupiterOne and select Nozomi Networks. Click New Instance to begin configuring your integration.

Creating an instance requires the following:

  • The Account Name used to identify the Nozomi account in JupiterOne. Ingested entities will have this value stored in tag.AccountName when the AccountName toggle is enabled.

  • Description to assist in identifying the integration instance, if desired.

  • Polling Interval that you feel is sufficient for your monitoring needs. You may leave this as DISABLED and manually execute the integration.

  • Your Nozomi Vantage URL — the base URL of your Vantage instance (the same URL you use for the web UI), in the form https://<tenant>.nozominetworks.io. This field is required.

  • Your Nozomi API Key Name — the API key name generated in your Vantage user profile. This field is required.

  • Your Nozomi API Key Token — the API key token generated alongside the key name. This field is required.

  • Historical Days — the number of days of historical alerts to retrieve (7, 30, 90, 180, or 365; default 30). Vulnerabilities are not time-bounded; the current set of matched CVEs is always ingested in full.

  • Optionally, Disable TLS Verification — intended only for on-premises Nozomi deployments that do not present a valid TLS certificate. Leave this off whenever possible and install valid certificates instead.

Click Create once all values are provided to finalize the integration.

Next steps​

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our Instance management guide to learn more about working with and editing integration instances.