Skip to main content

Zentral

Visualize Zentral managed devices, users, device apps, profiles, and certificates, and monitor changes through queries and alerts.

Installation​

JupiterOne requires a Zentral API token and the base URL of your Zentral instance. The service account that owns the token must be granted the Inventory::Action::"viewMachineSnapshot" PBAC action, which authorizes the full-inventory export used to collect all device, user, profile, certificate, and application data.

Configuration in Zentral​

Create a role​

  1. Log in to your Zentral console.
  2. Go to Platform settings > Roles.
  3. Click Add role, enter a name such as JupiterOne Inventory Reader, and save.
  4. Note the numeric ID displayed in the role list or URL — you will need it when writing the policy.

Create a Cedar policy​

  1. In Platform settings, go to Policies.

  2. Click Add policy, give it a descriptive name, and enable the Active toggle.

  3. Enter the following Cedar source, replacing <role-pk> with the numeric ID from the previous step:

    permit (
      principal in Role::"<role-pk>",
      action in [Inventory::Action::"viewMachineSnapshot"],
      resource
    );

  4. Save the policy.

Create a service account and generate a token​

  1. Go to Platform settings > Service accounts.
  2. Click Add service account, enter a name such as jupiterone, and assign it the JupiterOne Inventory Reader role.
  3. Save the service account, then open its detail page and click Add token.
  4. Copy the generated API token and store it securely — you will not be able to retrieve it again.
  5. Copy your Zentral base URL (the root URL of your instance, for example https://example.zentral.com).

Configuration in JupiterOne​

To install the Zentral integration in JupiterOne, navigate to the Integrations tab, select Zentral, and click New Instance.

Creating an instance requires the following:

  • Account Name — A label to identify this account in JupiterOne. Ingested entities store this value in tag.AccountName.

  • Description — Optional. Helps distinguish multiple integration instances.

  • Polling Interval — How often JupiterOne collects data from Zentral. Set to DISABLED to run manually.

  • Base URL — The root URL of your Zentral instance, for example https://example.zentral.com.

  • API Token — The API token generated in the steps above.

Click Create to finalize the integration.

Next steps​

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our Instance management guide to learn more about working with and editing integration instances.